Once executed, the attack encrypts the files in the compromised users’ accounts. Proofpoint has identified the attack chain and documented the steps below. Cloud ransomware attack chain The Attack Chain Our research focused on two of the most popular enterprise cloud apps - SharePoint Online and OneDrive within the Microsoft 365 and Office 365 suites and shows that ransomware actors can now target organizations’ data in the cloud and launch attacks on cloud infrastructure.

Proofpoint has discovered a potentially dangerous piece of functionality in Office 365 or Microsoft 365 that allows ransomware to encrypt files stored on SharePoint and OneDrive in a way that makes them unrecoverable without dedicated backups or a decryption key from the attacker.

However, that may not be the case for much longer.

After all, the now-familiar “AutoSave” feature along with versioning and the good old recycle bin for files should have been sufficient as backups. Until now, IT and security teams felt that cloud drives would be more resilient to ransomware attacks. Ransomware attacks have traditionally targeted data across endpoints or network drives.

Office online onedrive