A method for providing secure backup and recovery of files during ransomware attacks or other cyberattacks , the method comprising: storing , by one or more processors, received data (110; 160) at one or more storage nodes (132; 134; 706) coupled via a network to create a data backup at the one or more storage nodes (130; 706); storing , by the one or more processors, duplicated images of the data backup as backup images (172; 524; 720) at a disconnected storage node (150; 204; 408; 522) that is isolated from the network ; initiating , by the one or more processors and based on detection of target activity, an alarm state corresponding to the data backup; issuing , by the one or more processors, one or more application programming interface (API) calls (170; 410) to the disconnected storage node based on the alarm state, the API calls (170; 410) to cause retrieval of a most recent backup image from the disconnected storage nodes for use in performing system restore operations; prohibiting, by the one or more processors, access to the data backup at the one or more storage nodes based on the alarm state; and initiating, by the one or more processors, storage of recovered data at one or more other storage nodes coupled via the network to create a second data backup at the one or more other storage nodes by building new edge nodes (214; 526; 644; 714) to restore the most recent backup image , the new edge nodes being an air gap cluster; providing the most recent backup image to the new edge nodes (214; 526; 644; 714); and performing , by the one or more processors, one or more system recovery operations based on the most recent backup image received from the disconnected storage node , wherein the new edge nodes (214; 526; 644; 714) are put into production based on the retrieved backup image to restore the system. storing , by one or more processors, received data (110; 160) at one or more storage nodes (132; 134; 706) coupled via a network to create a data backup at the one or more storage nodes (130; 706); storing , by the one or more processors, duplicated images of the data backup as backup images (172; 524; 720) at a disconnected storage node (150; 204; 408; 522) that is isolated from the network ; initiating , by the one or more processors and based on detection of target activity, an alarm state corresponding to the data backup; issuing , by the one or more processors, one or more application programming interface (API) calls (170; 410) to the disconnected storage node based on the alarm state, the API calls (170; 410) to cause retrieval of a most recent backup image from the disconnected storage nodes for use in performing system restore operations; prohibiting, by the one or more processors, access to the data backup at the one or more storage nodes based on the alarm state; and initiating, by the one or more processors, storage of recovered data at one or more other storage nodes coupled via the network to create a second data backup at the one or more other storage nodes by building new edge nodes (214; 526; 644; 714) to restore the most recent backup image , the new edge nodes being an air gap cluster; providing the most recent backup image to the new edge nodes (214; 526; 644; 714); and performing , by the one or more processors, one or more system recovery operations based on the most recent backup image received from the disconnected storage node , wherein the new edge nodes (214; 526; 644; 714) are put into production based on the retrieved backup image to restore the system. <EOS>