---
title: What is SysCloud's Ransomware Protection Add-on?
description: "SysCloud's ransomware protection add-on is designed to detect and recover files affected by ransomware within your backup archives. It provides the following features: Ransomware detection Advanced ra"
---

[Skip to content](https://help.syscloud.com/what-is-sysclouds-ransomware-protection-add-on#main-content)

English

Show submenu for translations

[Create Ticket](https://help.syscloud.com/kb-tickets/new?hsLang=en)

![Untitled design (1)-Aug-01-2022-12-37-27-80-PM.png\]](https://help.syscloud.com/hs-fs/hubfs/Untitled%20design%20(1)-Aug-01-2022-12-37-27-80-PM.png?height=40&name=Untitled%20design%20(1)-Aug-01-2022-12-37-27-80-PM.png)

- [Help Center](https://help.syscloud.com/)
- [Go to SysCloud](https://www.syscloud.com/)

Open main navigation

Close main navigation

- [Help Center](https://help.syscloud.com/)
- [Go to SysCloud](https://www.syscloud.com/)
- English
  
  Show submenu for translations
- [Create Ticket](https://help.syscloud.com/kb-tickets/new)

 Hello. How can we help you?

- There are no suggestions because the search field is empty.

1. [Help Center](https://help.syscloud.com/?hsLang=en)
2. [Add-ons](https://help.syscloud.com/add-ons?hsLang=en)
3. [Ransomware](https://help.syscloud.com/add-ons?hsLang=en#ransomware)

# What is SysCloud's Ransomware Protection Add-on?

SysCloud's Ransomware Protection add-on helps organizations detect and recover files that may have been encrypted during a ransomware attack.

The add-on scans backed-up cloud data for suspicious encryption activity, identifies potentially affected files and users, and provides remediation and recovery actions. Administrators can investigate detected files, restrict access to affected content, and restore clean file versions from SysCloud backups.

### Ransomware detection

Ransomware generally infects user devices, such as laptops or desktops, and encrypts the files stored on them. When cloud synchronization applications such as Google Drive, Shared Drives, OneDrive, or SharePoint are used, the encrypted file versions may be synchronized to the cloud and replace the original versions.

SysCloud continuously analyzes backed-up files for encryption patterns and other indicators of possible ransomware activity. Files that SysCloud identifies as potentially encrypted are referred to as **encrypted files** throughout the Ransomware Protection dashboard and documentation.

##### Ransomware detection helps administrators:

- Identify files that may have been encrypted by ransomware.
- Identify the users and cloud applications affected by the incident.
- Review the detected files and their available backup versions.
- Receive alerts and notifications about potential ransomware activity.
- Investigate the scope and impact of the incident.

Detected files are displayed in the **Ransomware Protection** section of the SysCloud dashboard, where administrators can review the affected data and perform the required remediation actions.  

### Ransomware recovery

SysCloud allows administrators to recover clean versions of files that were modified, encrypted, or removed during a ransomware incident.

Using the backup snapshots available in SysCloud, administrators can:

- Restore a clean file version captured before the suspected ransomware activity.
- Recover files that may have been deleted by ransomware or by a user.
- Restrict access to affected files while the incident is being investigated.
- Transfer affected files to an administrator for further review.
- Remove potentially harmful files from the source cloud application or SysCloud Archives.

SysCloud can identify a safe snapshot for a detected file based on its analysis. Administrators can use this snapshot to restore the file to a version that existed before the suspected encryption activity.

### Supported applications

The Ransomware Protection add-on is available for the following applications:

#### Google Workspace

- Google Drive
- Shared Drives
- Gmail
- Google Classroom

#### Microsoft 365

- OneDrive
- SharePoint
- Outlook
- Microsoft Teams sites

### Actions available for detected encrypted files

The following actions are available for files identified as potentially encrypted.

**1. Transfer ownership**

Use ownership actions to transfer affected files to an administrator for investigation or return them to their original owner.

- **Transfer ownership**: Transfers ownership of the selected files to an administrator for further review. Refer to this [LINK](https://help.syscloud.com/how-to-transfer-ownership-of-a-ransomware-flagged-file?hsLang=en) for the steps.
- **Restore ownership**: Restores ownership of the selected files to their original owner when one or more ownership transfers have previously been performed. Refer to this [LINK](https://help.syscloud.com/how-to-restore-ownership-of-a-ransomware-flagged-file?hsLang=en) for the steps.
- **Quarantine files**: Removes all sharing permissions from the selected files and transfers their ownership to the SysCloud account owner. Refer to this [LINK](https://help.syscloud.com/how-do-i-quarantine-files-when-addressing-ransomware-violations-in-syscloud-backup?hsLang=en) for the steps.

**2. Remove sharing**

Use sharing-removal actions to restrict access to affected files while investigating the incident.

- **Remove all sharing:** Revokes all sharing permissions from the selected files. Only the file owner retains access. Refer to this [LINK](https://help.syscloud.com/how-to-remove-all-sharing-from-a-ransomware-flagged-file?hsLang=en) for the steps.
- **Remove link sharing**: Revokes access granted through shared links while retaining direct sharing permissions. Refer to this [LINK](https://help.syscloud.com/how-to-remove-link-sharing-from-a-ransomware-flagged-file-for-google-workspace?hsLang=en) for the steps.
- **Remove external domain sharing**: Revokes access granted to users from external domains through direct sharing or link sharing. Refer to this [LINK](https://help.syscloud.com/how-to-remove-external-sharing-from-a-ransomware-flagged-file?hsLang=en) for the steps.

**3. Restore from a safe snapshot**

Restores a clean version of the selected files using the safe snapshot identified by SysCloud. This action can also be used to recover files that may have been removed by ransomware or by a user.

Refer to this [LINK](https://help.syscloud.com/how-to-restore-from-a-safe-snapshot-after-ransomware-detection?hsLang=en) for the steps.

**4. Delete**

Deletes the selected affected files from SysCloud Archives or from the source cloud application.

Refer to this [LINK](https://help.syscloud.com/how-do-i-delete-encrypted-and-ransomware-infected-files-from-my-backup-archives-and-live-cloud?hsLang=en) for the steps.

**5. Dismiss**

Dismisses the ransomware alert when the detected files have been reviewed and determined not to pose a threat.

Refer to this [LINK](https://help.syscloud.com/how-to-dismiss-a-ransomware-violation?hsLang=en) for the steps.

- [Get started with Turbo backup](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#main-content)

    - [General](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#general)
    - [Account creation](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#account-creation)
    - [Create and configure backup jobs](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#create-and-configure-backup-jobs)
    - [Connect clouds](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#connect-clouds)
    - [Configure backup](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#configure-backup)
    - [Manage archives](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#manage-archives)
    - [Cloud Connection](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#cloud-connection)
    - [Notification Center](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#notification-center)
    - [Settings](https://help.syscloud.com/get-started-with-turbo-backup?hsLang=en#settings)
- [Manage Legacy backup](https://help.syscloud.com/manage-legacy-backup?hsLang=en#main-content)

    - [General](https://help.syscloud.com/manage-legacy-backup?hsLang=en#general)
    - [SysCloud application](https://help.syscloud.com/manage-legacy-backup?hsLang=en#syscloud-application)
    - [Backup archives](https://help.syscloud.com/manage-legacy-backup?hsLang=en#backup-archives)
    - [Error messages](https://help.syscloud.com/manage-legacy-backup?hsLang=en#error-messages)
- [Google Workspace](https://help.syscloud.com/google-workspace?hsLang=en#main-content)

    - [Setup Google Workspace backup](https://help.syscloud.com/google-workspace?hsLang=en#setup-google-workspace-backup)
    - [Google Admin Console](https://help.syscloud.com/google-workspace?hsLang=en#google-admin-console)
    - [Google Chat](https://help.syscloud.com/google-workspace?hsLang=en#google-chat)
    - [Backup archives](https://help.syscloud.com/google-workspace?hsLang=en#backup-archives)
    - [Restore](https://help.syscloud.com/google-workspace?hsLang=en#restore)
    - [Export](https://help.syscloud.com/google-workspace?hsLang=en#export)
    - [Errors](https://help.syscloud.com/google-workspace?hsLang=en#errors)
    - [Sync](https://help.syscloud.com/google-workspace?hsLang=en#sync)
    - [Cloud connection](https://help.syscloud.com/google-workspace?hsLang=en#cloud-connection)
- [Google Classroom](https://help.syscloud.com/google-classroom?hsLang=en#main-content)

    - [Setup Google Classroom backup](https://help.syscloud.com/google-classroom?hsLang=en#setup-google-classroom-backup)
    - [Backup archives](https://help.syscloud.com/google-classroom?hsLang=en#backup-archives)
    - [Restore](https://help.syscloud.com/google-classroom?hsLang=en#restore)
    - [Export](https://help.syscloud.com/google-classroom?hsLang=en#export)
- [Microsoft 365](https://help.syscloud.com/microsoft-365?hsLang=en#main-content)

    - [Setup Microsoft 365 backup](https://help.syscloud.com/microsoft-365?hsLang=en#setup-microsoft-365-backup)
    - [Backup archives](https://help.syscloud.com/microsoft-365?hsLang=en#backup-archives)
    - [Restore](https://help.syscloud.com/microsoft-365?hsLang=en#restore)
    - [Export](https://help.syscloud.com/microsoft-365?hsLang=en#export)
    - [Errors](https://help.syscloud.com/microsoft-365?hsLang=en#errors)
    - [Sync](https://help.syscloud.com/microsoft-365?hsLang=en#sync)
- [Slack](https://help.syscloud.com/slack?hsLang=en#main-content)

    - [Setup Slack backup](https://help.syscloud.com/slack?hsLang=en#setup-slack-backup)
    - [Slack Backup archives](https://help.syscloud.com/slack?hsLang=en#slack-backup-archives)
    - [Restore Slack data](https://help.syscloud.com/slack?hsLang=en#restore-slack-data)
    - [Export Slack data](https://help.syscloud.com/slack?hsLang=en#export-slack-data)
    - [Resolve Slack errors](https://help.syscloud.com/slack?hsLang=en#resolve-slack-errors)
- [QuickBooks Online](https://help.syscloud.com/quickbooks-online?hsLang=en#main-content)

    - [Setup QuickBooks Online backup](https://help.syscloud.com/quickbooks-online?hsLang=en#setup-quickbooks-online-backup)
    - [Backup archives](https://help.syscloud.com/quickbooks-online?hsLang=en#backup-archives)
    - [Restore](https://help.syscloud.com/quickbooks-online?hsLang=en#restore)
    - [Export](https://help.syscloud.com/quickbooks-online?hsLang=en#export)
- [Xero](https://help.syscloud.com/xero?hsLang=en#main-content)

    - [Backup archives](https://help.syscloud.com/xero?hsLang=en#backup-archives)
    - [Export](https://help.syscloud.com/xero?hsLang=en#export)
    - [Setup Xero backup](https://help.syscloud.com/xero?hsLang=en#setup-xero-backup)
- [HubSpot](https://help.syscloud.com/hubspot?hsLang=en#main-content)

    - [Setup HubSpot backup](https://help.syscloud.com/hubspot?hsLang=en#setup-hubspot-backup)
    - [Backup archives](https://help.syscloud.com/hubspot?hsLang=en#backup-archives)
    - [Restore](https://help.syscloud.com/hubspot?hsLang=en#restore)
    - [Export](https://help.syscloud.com/hubspot?hsLang=en#export)
    - [Errors](https://help.syscloud.com/hubspot?hsLang=en#errors)
- [Salesforce](https://help.syscloud.com/salesforce?hsLang=en#main-content)

    - [Setup Salesforce backup](https://help.syscloud.com/salesforce?hsLang=en#setup-salesforce-backup)
    - [Backup archives](https://help.syscloud.com/salesforce?hsLang=en#backup-archives)
    - [Restore](https://help.syscloud.com/salesforce?hsLang=en#restore)
    - [Export](https://help.syscloud.com/salesforce?hsLang=en#export)
    - [Errors](https://help.syscloud.com/salesforce?hsLang=en#errors)
- [Box](https://help.syscloud.com/box?hsLang=en#main-content)

    - [Setup backup](https://help.syscloud.com/box?hsLang=en#setup-backup)
    - [Restore Box Data](https://help.syscloud.com/box?hsLang=en#restore-box-data)
    - [Resolve errors](https://help.syscloud.com/box?hsLang=en#resolve-errors)
    - [Export](https://help.syscloud.com/box?hsLang=en#export)
- [Sky - AI Copilot](https://help.syscloud.com/sky-ai-copilot?hsLang=en)
- [Add-ons](https://help.syscloud.com/add-ons?hsLang=en#main-content)

    - [Turbo backup](https://help.syscloud.com/add-ons?hsLang=en#turbo-backup)
    - [Advanced ransomware recovery](https://help.syscloud.com/add-ons?hsLang=en#advanced-ransomware-recovery)
    - [Archiver](https://help.syscloud.com/add-ons?hsLang=en#archiver)
    - [Data change insights](https://help.syscloud.com/add-ons?hsLang=en#data-change-insights)
    - [Security & Compliance](https://help.syscloud.com/add-ons?hsLang=en#security-compliance)
    - [eDiscovery](https://help.syscloud.com/add-ons?hsLang=en#ediscovery)
    - [Ransomware](https://help.syscloud.com/add-ons?hsLang=en#ransomware)
    - [Resolve errors](https://help.syscloud.com/add-ons?hsLang=en#resolve-errors)
- [Partner Portal](https://help.syscloud.com/partner-portal?hsLang=en#main-content)

    - [Automated onboarding](https://help.syscloud.com/partner-portal?hsLang=en#automated-onboarding)
- [Subscription and payments](https://help.syscloud.com/subscription-and-payments?hsLang=en#main-content)

    - [Manage subscription (Turbo backup)](https://help.syscloud.com/subscription-and-payments?hsLang=en#manage-subscription-turbo-backup)
    - [Manage subscription (Legacy backup)](https://help.syscloud.com/subscription-and-payments?hsLang=en#manage-subscription-legacy-backup)
    - [Manage Licenses (Turbo backup)](https://help.syscloud.com/subscription-and-payments?hsLang=en#manage-licenses-turbo-backup)
    - [Manage Licenses (Legacy backup)](https://help.syscloud.com/subscription-and-payments?hsLang=en#manage-licenses-legacy-backup)
    - [Billing FAQs](https://help.syscloud.com/subscription-and-payments?hsLang=en#billing-faqs)
    - [US sales tax FAQs](https://help.syscloud.com/subscription-and-payments?hsLang=en#us-sales-tax-faqs)
- [Manage admin roles](https://help.syscloud.com/manage-admin-roles?hsLang=en#main-content)

    - [Admin roles (Turbo backup)](https://help.syscloud.com/manage-admin-roles?hsLang=en#admin-roles-turbo-backup)
- [Settings](https://help.syscloud.com/settings?hsLang=en#main-content)

    - [Security](https://help.syscloud.com/settings?hsLang=en#security)
    - [Manage account](https://help.syscloud.com/settings?hsLang=en#manage-account)
    - [Manage users](https://help.syscloud.com/settings?hsLang=en#manage-users)
    - [Manage domains](https://help.syscloud.com/settings?hsLang=en#manage-domains)
    - [Backup](https://help.syscloud.com/settings?hsLang=en#backup)
- [K-12 Security & Compliance](https://help.syscloud.com/k-12-security-compliance?hsLang=en#main-content)

    - [General](https://help.syscloud.com/k-12-security-compliance?hsLang=en#general)
    - [Google Workspace security and compliance](https://help.syscloud.com/k-12-security-compliance?hsLang=en#google-workspace-security-and-compliance)
    - [Microsoft 365 security and compliance](https://help.syscloud.com/k-12-security-compliance?hsLang=en#microsoft-365-security-and-compliance)
- [Google Drive Encryption](https://help.syscloud.com/google-drive-encryption?hsLang=en)
- [Uncategorized](https://help.syscloud.com/uncategorized?hsLang=en)
- [Shopify](https://help.syscloud.com/shopify?hsLang=en#main-content)

    - [Setup backup](https://help.syscloud.com/shopify?hsLang=en#setup-backup)
    - [Restore](https://help.syscloud.com/shopify?hsLang=en#restore)
    - [Export](https://help.syscloud.com/shopify?hsLang=en#export)
- [Ransomware](https://help.syscloud.com/ransomware?hsLang=en)
- [Cookie consent](https://help.syscloud.com/cookie-consent?hsLang=en)
- [Google Admin Console](https://help.syscloud.com/google-admin-console?hsLang=en)
- [Microsoft O365](https://help.syscloud.com/microsoft-o365?hsLang=en#main-content)

    - [Restore](https://help.syscloud.com/microsoft-o365?hsLang=en#restore)
    - [Export](https://help.syscloud.com/microsoft-o365?hsLang=en#export)
    - [Backup Archives](https://help.syscloud.com/microsoft-o365?hsLang=en#backup-archives)

- [Go to SysCloud](https://www.syscloud.com/)
- [Create Ticket](https://www.syscloud.com/support/ticket/)

[![Chill listening crop-3](https://help.syscloud.com/hs-fs/hubfs/Syscloud%20logo@2x-100.jpg?width=116&height=24&name=Syscloud%20logo@2x-100.jpg "Chill listening crop-3")](https://www.syscloud.com/)

SysCloud Help Center

Copyright © 2025, SysCloud Inc.