They usually embed themselves in within the system files and have some scheduled job that basically checks for the criteria - if you are only backing up and restoring user data then it's a non-issue, but if you do a full recovery including the system files/the system scheduler etc, then it can happen, and it is often necessary to backup executable and system files for production environments (true, not so much for individual users and their systems).

When I was working in an IT shop, one of our clients was ransomwared with this method. The saving grace for us in that instance is that our backups were going to a product that allowed you to easily break open and dissect the compressed backups pre-recovery, so we were able to determine where the malicious files were and kill them before pushing the backups. Of course we only noticed that it was in the backups after we had tried to push the backups once already, so it was quite the timely process - I think I worked for something like 18 hours that day.

You can read about such malware if you search for "timebomb malware" or "malware does not execute until date" etc.

The attack is not super common anymore, but still happens.

For example, here is an article discussing time bomb methods on linkedin.

https://www.linkedin.com/pulse/time-bombs-malware-delayed-execution-any-run

Another on the knowbe4 blog:

https://blog.knowbe4.com/ransomware-can-destroy-backups-in-four-ways