I have several Windows machines that do automatic backups to external or internal backup drives. This happens automatically during off hours, and it needs to stay that way with no manual intervention required. For example, disconnecting and reconnecting external drives isn't an acceptable option.
However, since those drives are connected, ransomware is a very real threat to them. As a defense, I am considering mounting the backup volumes only when needed to do a backup and then dismounting them immediately after the backup is done.
I know this isn't a perfect defense since malware that gains admin privileges could mount those drives just as easily as I can, but that seems like an unlikely thing for malware to do since unmounted drives aren't normally of much interest. (Or they're of great interest, I'm not sure which.)
I'm willing to take the risk of encountering zero day malware capable of doing that, but would that behavior really be zero day? Or has malware that scans for and mounts unmounted volumes already been seen in the wild?