The collection and exfiltration phase is unique to Microsoft environments. At this point, the attacker can ask for a ransom from the organization.ДЇigure 1: Cloud ransomware attack chain diagram. Monetization:В Now all original (pre-attacker) versions of the files are lost, leaving only the encrypted versions of each file in the cloud account.In some cases, the attacker may exfiltrate the unencrypted files as part of a double extortion tactic. This step is unique to cloud ransomware compared to the attack chain for endpoint-based ransomware. With the example limit of 1, encrypt the file twice. Encrypt the file more times than the versioning limit. Collection & Exfiltration:В Reduce versioning limit of files to a low number such as 1, to keep it easy.Account Takeover & Discovery:В The attacker now has access to any file owned by the compromised user or controlled by the third-party OAuth application (which would include the userвЂ™s OneDrive account as well).

Initial Access:В Gain access to one or more usersвЂ™ SharePoint Online or OneDrive accounts by compromising or hijacking usersвЂ™ identities.

The actions outlined below can be automated using Microsoft APIs, command line interface (CLI) scripts and PowerShell scripts. Like with endpoint ransomware activity, those files can only be retrieved with decryption keys. Once executed, the attack encrypts the files in the compromised usersвЂ™ accounts. Proofpoint has identified the attack chain and documented the steps below. Cloud ransomware attack chain The Attack Chain Our research focused on two of the most popular enterprise cloud apps - SharePoint Online and OneDrive within the Microsoft 365 and Office 365 suites and shows that ransomware actors can now target organizationsвЂ™ data in the cloud and launch attacks on cloud infrastructure. Proofpoint has discovered a potentially dangerous piece of functionality in Office 365 or Microsoft 365 that allows ransomware to encrypt files stored on SharePoint and OneDrive in a way that makes them unrecoverable without dedicated backups or a decryption key from the attacker. However, that may not be the case for much longer. After all, the now-familiar вЂњAutoSaveвЂќ feature along with versioning and the good old recycle bin for files should have been sufficient as backups.

Until now, IT and security teams felt that cloud drives would be more resilient to ransomware attacks. Ransomware attacks have traditionally targeted data across endpoints or network drives.

Microsoft outlook 365