Microsoft 365 Function Leaves SharePoint, OneDrive Files Open to Ransomware Attacks

SharePoint and OneDrive libraries can be encrypted in ransomware attack, researchers say.

Dark Reading Staff, Dark Reading

June 16, 2022

1 Min Read
Concept art meant to illustrate a ransomware attack
Source: Marcos Alvarado via Alamy

Enterprise cloud services like Microsoft 365 leave enterprises open to ransomware threat actors who want to encrypt files saved in SharePoint Online and OneDrive libraries, researchers warn. 

The new target marks a potential pivot point for ransomware attackers running out of luck focusing on endpoints and network drives and might find less resistance attacking cloud infrastructure, new research from Proofpoint says. The team was able to document the attack chain from initial credential compromise to account takeover, discovery, exfiltration, and, ultimately, the ransom demand. 

"Until now, IT and security teams felt that cloud drives would be more resilient to ransomware attacks," the Proofpoint team wrote along with their findings. "After all, the now-familiar 'AutoSave' feature along with versioning and the good old recycle bin for files should have been sufficient as backups. However, that may not be the case for much longer."

About the Author

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights