Ransomware walla Mumtugol keewngol e nder Google Drive, OneDrive, walla Dropbox Sinkronisaasiyoŋ Piile bonɗe e Kaɓirɗe kala (Taariindi mbaydi balɗe 30 e Rewind Vault)¶

Yeewtude nate sinkronisaasiyoŋ e nder barre gollorde maa Windows walla barre menyu macOS ina yirloo e yaawre no ujunnaaje ujunnaaje binndanɗe njulaagu, binndanɗe njoɓdi, fotooje ɓesngu, e piille kode iwdi nder Google Drive for Desktop, Microsoft OneDrive, Dropbox, walla iCloud Drive ko ransomware (.locked, .bianlian, .akira, .play, .lockbit) walla momtaama e mbaydi mbaylaandi rsync --delete, jolngo e jolngo foldere aksidaa, walla binndol fenaande ko musiiba dokke jaawɗe. Sabu kiliyaneeɓe sinkronisaasiyoŋ birooji ruulde ina peewniree ngam ƴellitde mbaydiiji ɗiɗi e sahaa goonga (inotify dow Linux, FSEvents e dow macOS, e ReadDirectoryChangesW / Cloud Filter API e dow Windows), binndol ranndo walla aksidaa Shift + Delete e dow laptop gooto gonɗo e ñawu nguu ina yaaji ɗoon e ɗoon haa to serveer ruulde oo, ina ɓuuɓnee les haa kala desktop goɗɗo, laptop, e foldere ekipaaji renndini jokkondirnde e ndeen konte e nder leƴƴanɗe seeɗa.

Kono, moteriiji sinkronisaasiyoŋ ruulde ko wonaa raw disk overwrites: caggal laylaytol, Microsoft OneDrive, Dropbox, Google Drive, e Box jogaade desorɗe geɗe ɗe mbaylaaka to bannge serwer e Daartol mbaydi toɓɓere-e-waktu balɗe 30 haa 180, Bins Recycle-Bins-Stage ɗiɗaɓo, e kuutorɗe rollback konte fof (OneDrive Restore Your OneDrive e Dropbox Rewind). So tawii ko ɗoon e ɗoon a taƴii ordinateer mo ñawu nguu heɓtii oo e lowre ndee, a dartina sinkronisaasiyoŋ e masiŋaaji ɗiɗaɓi ngam mooftude kaɓirɗe nokkuuje ɗe ngonaa e laylaytol, kadi a woɗɗitoo jolngo bonngo ngo jolnude piille sifirteeɗe e dow quota daartol mbaydi maa, aɗa waawi ruttaade e diski maa ruulde oo fof e hojomaaji seeɗa hade sifirgol walla momtugol paso a ranout fuɗɗaade e. Ngam jogaade malware masiŋ nokkuure e carving filesystem, ƴeewto ardotooɓe amen e jaabawol ranndomaaji e mborosaaji bonɗi, momtugol fiilngo e aksidaa e ƴellitgol disko format, e backups ordinateeruuji : peeje 3-2-1 e reentaade musiiba. So tawii ransomware yanii e opitaal, e kilinik, walla e lowre neldugol cafrirɗe, ɗoon e ɗoon, softin laabi downtime kilinik ɗi ngonaa e laylaytol, noddu limoore cafrirɗe nokku maa (911 to leyɗeele dentuɗe Amerik e Kanadaa, 112 e nder Dental Orop fof, 999 e nder leydi Angalteer) walla ƴeewto regginorde amen e limooje caɗtuɗe.

Waɗde ɗum jooni¶

1. Ittu kaɓirgal Ethernet ngal, ɓuuɓna Wi-Fi e ordinateer iwdi oo ƊOO ƊOO (ko adii nde uddata apps walla ɓuuɓna huunde):
2. Ko waɗi taƴde lowre ndee ina hisna lowre maa cloud vault: Kala leƴƴannde ordinateer gonɗo e ñawu nguu walla momtuɗo oo ina heddii e internet, kiliyan sinkronisaasiyoŋ desktop (OneDrive.exe, GoogleDriveFS.exe, Dropbox.exe) ina nelda 50 haa 200 golle fiilde goɗɗe cifaaɗe walla mumtaaɗe e leƴƴannde kala e nder API ruulde. Taƴde Wi-Fi e Ethernet ina ɓuuɓna doggol jolngo ruulde e nder laabi mum.
3. Yahdu e KALA laptop, desktop, tablet, e telefoŋ GOƊƊO jokkondirɗo e konte ruulde wootere e OFF Wi-Fi / Ethernet mum en HADDE umminde ekkoraaji mum en:
4. Laptop maa ɗiɗaɓo offline ko kapsul waktu pristine: So tawii desktop maa galle walla MacBook ɗiɗaɓo ina ɗaanii e nder saak maa gila hanki, nokku mum OneDrive, Dropbox, walla Google Drive (Mirror files / Always keep on this device) foldere ina jogii haa jooni 100 e nder teemedere koppiiji piille maa ɗi cifaaka, ɗi meeɗaa meemde.
5. So a umminii oon laptop ɗiɗaɓo tawa Wi-Fi ina huɓɓi, demon sinkronisaasiyoŋ ruulde oo jokkondirta ɗoon e ɗoon, ƴetta binndanɗe cifaaɗe momtugol mawngol walla ransomware e nder serveer oo, bonna oon koppi nokkuure laaɓtunde e nder leƴƴanɗe 60. Mumtu router Wi-Fi galle maa (ƴettu kaɓirgal mum) hade maa umminde kala ordinateer ɗiɗaɓo, caggal ɗuum ƴettu foldere nokkuure ndee e diski USB yaajɗo tawa aɗa woni e laylaytol.
6. So tawii sabaabu mum ko Ransomware, ƴettu kaɓirgal doole (walla doole-jogaade butoŋ Power fotde leƴƴanɗe 10) e PC mo ñawu nguu heɓi oo ; so tawii sabaabu oo ko Mumtugol Accidentel e SSD, accu ɗum ina woɗɗi, ƴettu/dartin daemon sinkronisaasiyoŋ:
7. Ransomware: Doole pullo ina dartina jokkorgal sifirde (AES / ChaCha20 gollotooɓe) ummoraade e siifde heddiiɓe e foldere nde siiftaaka e nder disko maa nokkuure e reende kuutorɗe RAM mbaylotooɗe so tawii ƴeewndo ciimtol forensik ina haani.
8. Suuɓde e aksidaa: Warde OneDrive.exe / Dropbox.exe / GoogleDriveFS.exe nder Gardiiɗo golle (Ctrl + Shift + Esc) walla Activity Monitor ɗoon e ɗoon mbele kiliyan nokku oo ina woppa doggol DELETE Noddaali API.
9. WOTO momtu e junngo maa piille ransomware (.locked) e nder jokkorgal web ruulde so tawii malware wayli innde ɓeydooje fiilde:
10. Faam no ransomware jokkondirta e mooftirgel ruulde:
    • Case A: Binndol e nokku (Innde Fiilde wootere): Ransomware sifiraaɗo Tax_2025.xlsx e hisnude payndaale sifirteeɗe ɗee e innde wootere tigi Tax_2025.xlsx. Ɗoo, sarwiis ruulde oo ina jogoo fiilde sifirnde ndee no Version 2 nii, tawa fiilde maa laaɓnde asliire ndee ina jooɗii e les mum e kisal no Version 1 in Version History.
    • Case B: Waylu innde + Mumtu asli (Tax_2025.xlsx.lockbit): Ko ɓuri heewde e ranndomaaji jamaanu ina njannga Tax_2025.xlsx, winnda fiilde hesere inniraande Tax_2025.xlsx.lockbit, e mumtude asliiji ɗii Tax_2025.xlsx. Ɗoo, asli maa laaɓɗo Tax_2025.xlsx ina jooɗii e nder Ɓoornugol / Ɓoornugol Duunde (e rollback konte toɓɓere-e-waktu).
11. Naatde e portal web ruulde (onedrive.live.com, dropbox.com, drive.google.com, icloud.com) ummoraade e kaɓirgal LAAƁƊAL, ngal ALAA ƁURI (hono telefoŋ cinndel e dokke celluka walla ordinateer keeriiɗo):
12. Hoto meeɗ naatde e konte maa ruulde gila e ordinateer mo ransomware heɓi oo, ɗoon e ɗoon waɗtu jokkorde kaɓirgol OAuth ordinateer mo ransomware oo les hello maa Google, Microsoft, walla Dropbox Account Security ngam ordinateer mo ransomware oo waawa fuɗɗaade sinkronisaasiyoŋ so tawii won udditii ɗum.
13. Kuutoro Rollback konte toɓɓere-e-waktu (Restore your OneDrive walla Dropbox Rewind) e nokku ɗo 50 000 fiilde gooto gooto:
14. Microsoft OneDrive e Dropbox fof ina njogii masiŋ otomaatik waktuuji konte fof, baawɗo ruttaade kala foldere, mbaydi fiilde, e huunde momtaande e nder diski maa fof, ruttaade e waktuuji keertiiɗi (1 hour ago, Yesterday at 11:00 PM, walla haa... 30 to 180 days ago) e nder gollal gootal bannge serwer.

Lekki kuule : reentaade musiiba sinkronisaasiyoŋ ruulde e ƴellitgol toɓɓere-e-waktu¶

Huutoro ndee ɗoo doggol golle caɗtungol ngam dartinde yaajde sinkronisaasiyoŋ hakkunde kaɓirɗe e artirde ngonka ruulde maa laaɓnde:

flowchart TD
    Start["Sifirde Ransomware WALLA Sinkronisaasiyoŋ momtugol maslahaa e aksidaa e nder disko ruulde"] --> CutNet["ƊATAL 1: Sokkit Ethernet & Mumtu Wi-Fi e ordinateer iwdi ɗoon e ɗoon (Walla Sokkit kaɓirgal doole router Wi-Fi)"]

    CutNet --> SaveSecondaries["ƊATAL 2: Waɗde Denndaangal Laptopuuji/PC-ji ɗiɗaɓi ɗi ngonaa e laylaytol (Mode Aeroplane) -> Koppir 'OneDrive / Dropbox / Google Drive' mum en nokkuuji mum en e nder diski USB yaajɗo"]

    SaveSecondaries --> RevokeSession["ƊATAL 3: Gila e Telefoŋ/Navigateur Laaɓɗo, Uddit Kisal Konte (Google / Microsoft / Dropbox) -> Woppu / Sokkit Joɗnde Sinkronisaasiyoŋ Desktop PC gonɗo e ñawu nguu"]

    RevokeSession --> WhichCloud{"Hol ko woni Platform mooftirɗo duule mo Hit?"}

    WhichCloud -->|"Mikrosoft OneDrive / SharePoint (Neɗɗo walla Mikrosoft 365)"| OneDriveRestore["Huutoro 'Cuɓe -> Cuɓe -> Wartir OneDrive maa' (Rewtin denndaangal waylooji, inɗe, & momtugol e nder konte ɗee kala haa balɗe 30) + Ƴeewto 1st & 2nd-Stage Recycle Bin"]

    WhichCloud -->|"Dropbox (Plus, Galle, Karallaagal, Njulaagu, walla Basic)"| DropboxRestore["Huutoro 'Dropbox Rewind' e Doggol Root (Rewind Konte ɗee kala e Hojomaaji laaɓtuɗi hade Njoɓdi) WALLA Huutoro 'Fiildeeji mumtaaɗi' + 'Kewuuji' Log (Balɗe 30 haa 180)"]

    WhichCloud -->|"Disko Google (Gmail keeriiɗo walla nokku gollorɗo Google)"| GDriveRestore["1. Sortu 'Trash' e 'ñalngu Trash' ngam Bulk-Restore Asliiji Mumtaaɗi. 2. Ngam Fiildeeji binndaaɗi dow: Ɓoɗɗu -> 'Kabaruuji fiilde -> Njuɓɓudi mbaydiiji' WALLA Doggol Google Drive API v3 Script Rollback Rewindaade Keewɗo"]

    WhichCloud -->|"Diisnondiral iCloud Apple"| iCloudRestore["Naat e 'iCloud.com/recovery' -> Ɓoɗɗu 'Restore Files' (Restore Files momtaaɗi e nder balɗe 30 cakkitiiɗe ɗee, hay so tawii ko ɗi ɓuuɓɗi gila e momtaaɗi ko ɓooyaani ɗii)"]

Faandaare 1: No moteriiji sinkronisaasiyoŋ duule kuutortoo ransomware vs.¶

Ko adii nde ɓuuɓtoto-ɗaa butoŋ restore e nder kulol, ƴeewto no piille maa waylirtee e portal web ruulde (drive.google.com, onedrive.live.com, walla dropbox.com). Kala kewu sinkronisaasiyoŋ duule ina fawii e gootal e paandaale karallaagal tati :

Faandaare 2 : Ƴellitaare ruulde platform-by-plateforme e ƴellitgol mbaydi keewndi¶

Rewtu laawol laaɓtungol ngam heɓtude dokkoowo maa ruulde ummoraade e feerorde laaɓnde, nde alaa ko bonnata.

1. Mikrosoft OneDrive & SharePoint Online (Restore Your OneDrive & Bin Recycle 2-Daawal)¶

Microsoft waɗii OneDrive ngam daɗde e sifirde ransomware e momtugol sinkronisaasiyoŋ keewɗo:

1. Laawol A: Rollback toɓɓere-e-waktu konte-fuu (Restore your OneDrive):
2. Ina tawee e Microsoft 365 Neɗɗo, Galle, Njulaagu, e Njulaagu (SharePoint Online defte binndaaɗe):
3. Naatde e onedrive.live.com (walla portal web maa Microsoft 365 OneDrive) e ordinateer laaɓɗo.
4. Ɓoɗɗu Ikon Gear Cuɓe (to dow-nyaamo) -> suɓo Options -> ɓuɗɗu Restore your OneDrive e nder lowre naatgol nano (e lowe goomu SharePoint, ɓuɗɗu Settings Gear -> Restore this library).
5. Les Select a date, suɓo Yesterday (walla Custom date and time).
6. Ƴeew Tablo Histogramme Golle : maa a yiy ƴoƴre mawnde e dow doggol waktuuji maantinirɗi minit tigi rigi mo sifirde ransomware walla momtugol keewngol fuɗɗii.
7. Ƴeewto jokkorgal waktuuji to nano oon spike (hono noon kala fiilde bonnde wayli innde, winndi, e momtugol sosaande caggal oon minit ƴeewtee ngam ustude).
8. Ɓoɗɗu Restore. Serveeji Microsoft maa ustoy kala waylo-waylo fiilngo, momta ransomware keso oo .locked fiildeeji, e artirde denndaangal fiildeeji asliiji mumtaaɗi ɗii e mbaydi foldere mum en laaɓtunde gila ko adii nde kewu nguu waɗata.
9. Laawol B: "Bin Recycle-Stage Second" Suuɗiiɗo (Nde Bin Recycle no woorunoo oo woppitaa):
10. Hol ko woni so tawii ñaawoowo (walla binndol otomaatik) naatii e jokkorgal maa web OneDrive/SharePoint, ɓuuɓtii Empty recycle bin?
11. E nder OneDrive ngam Njulaagu / SharePoint Online (e konte Microsoft 365), ustude Binndital gadanal ngal momtataa piille maa. E nder ɗuum, ina nawta ɗe e nder Bin Recycle-Bin suuɗiiɗo (Site Collection Recycle Bin) ɗo ɓe keddii e ndeenka haa balɗe 93 fof:
    1. Uddit Recycle bin e nder jokkorgal nano OneDrive.
    2. Yillo haa les hello ngoo, ɓuɗɗu e jokkorde tokosere janngunde: Can't find what you're looking for? Check the Second-stage recycle bin.
    3. Suɓo piille ɗee kala, ɓuɗɗu Restore.

2. Kaɓirgal (Dropbox Rewind, Events Rolde caggal, e Deleted Files)¶

1. Laawol A: Huutoraade Dropbox Rewind ngam ruttaade caggal Dowlaaji ɗii fof walla Konte maa fof:
2. Ina tawee e Dropbox Plus, peeje ɓesngu, karallaagal, e njulaagu (30 days to 180 days ƴeew caggal):
3. Naatde e dropbox.com e dow feerorde laaɓnde.
4. Ngam ruttaade e konte maa Dropbox fof laawol gootol, ƴettu junngo maa dow All files hoore (walla ɓuɗɗu e ... (Golle goɗɗe) menyu e nder laylaytol golle bannge ñaamo so tawii alaa foldere keertiinde nde cuɓaaka) e ɓuɗɗude Rewind this folder (walla Rewind Dropbox).
5. Ɓoɗɗu Get started -> ƴeew nate golle ñalnde kala ngam yiytude spike nde ransomware walla deletion waɗi -> ɓuɗɗu e oon ñalawma ngam zoomde e waktu-waktu / minit-hojom.
6. Joɗɗin doggol bulo gonngol dow ngol ko adii kewu bonɗo oo fuɗɗaade, ɓuɗɗu Continue, e ɓuɗɗude Rewind.
7. Dropbox maa wartir denndaangal piille binndaaɗe, laaɓtina binndanɗe ransomware kese ɓeydaaɗe ɗee, ummina denndaangal foldereeji mumtaaɗi e nokku mum en.
8. Laawol B: Hol ko woni so aɗa woni e Free Dropbox Basic konte (to Dropbox Rewind ina udditaa)?
9. Teeŋtuɗo: Hay e dow free Dropbox Basic (2 GB) konte, Dropbox ina jogii haa jooni balɗe 30 timmuɗe Version History e balɗe 30 Deleted Files recovery ngam kala fiilde wootere e serweeji maɓɓe.
10. Cuɓal 1 (Rewtinnde e junngo tawa ko e njoɓdi): Ɓoɗɗu Deleted files e nder lowre nano nde dropbox.com ngam filtoraade ñalngu e artirde asliiji mumtaaɗi ɗii e keewal; walla ɓuɗɗu ... -> Activity -> Version history e kala fiilngo winndaango ngam artirde ƴeewndo laaɓtungo ɓennungo ngoo.
11. Cuɓal 2 (Ko ɗoon e ɗoon Dropbox Plus Upgrade Unlock): Sabu Dropbox ina winnda doggol kewuuji lesɗi ɗii e denndaangal konte tawa ko e tier, ɓeydugol a Dropbox Basic konte to Dropbox Plus ($11.99 ngam lewru 1) caggal nde kewu udditi Dropbox Rewind UI e nder balɗe 30 jawtuɗe ɗee e kewuuji fiilngo winndaaɗi jooni ɗii.

3. Disko Google e nokku gollorɗo Google (Trash, Manage Versions, Admin Console 25-Day Post-Trash Recovery, e API mawɗo)¶

Google Drive wayi ko no OneDrive e Dropbox nii, alaa butoŋ gooto "Rewind Entire Drive" e nder UI kuutortooɗo oo, ko ɗum waɗi aɗa foti huutoraade feere ƴellitgol moƴƴere fawaade e so tawii piille ɗee muumtaama walla mbinndaama e nokku:

1. Heɓtude asliiji mumtuɗi e Google Drive Trash (Ngam waylude innde+Mumtugol Ransomware walla Mumtugol keewngol):
2. Uddit drive.google.com/drive/trash e nder feerorde desktop.
3. Dobo e Trashed date hoore colonel ngam renndinde piille ɓurɗe ɓooyde momteede ɗee haa dow.
4. Ɓoɗɗu fiilngo laaɓngo adanngo ngo ransomware/aksidaa momti, ƴettu les, jogo Shift + ɓuɗɗu fiilngo cakkitiingo e nder batch, ɓuɗɗu e ñaamo, cuɓo-ɗaa Restore (Ctrl + Z walla ikon waktu Restore). Kala fiilde ina hoota to foldere mum jibinannde nested asliire.
5. Hol ko waɗi so Google Drive Trash wonnoo ko Emptied? (Google One Support & Google Workspace Admin 25-Day Rescue):
6. Google Workspace (Njulaagu, Sosiyetee, Jaŋde, Golle ɗe ngalaa ngartam): Hay caggal nde kuutortooɗo oo ɓuuɓtii Empty trash -> Delete forever, serwooɓe Google ina njogii piille laaɓtuɗe ɗee fotde balɗe 25 goɗɗe. Naat e nder admin.google.com ko Admin mawɗo -> yah to Directory -> Users -> ɓuɗɗu e kuutortooɗo toɗɗaaɗo oo -> ƴettu les haa More options (walla ɓuɗɗu e panne nano les ciimtol kuutortooɗo) -> ɓuɗɗu Restore data -> suɓo Date Range (haa balɗe 25 caggal), suɓo Drive no kuutorgal ngal nii, e ɓuɗɗude Restore.
7. Konte Gmail / Google One: So tawii lowre maa Google Drive keeriinde ndee ustaama e nder balɗe 25 cakkitiiɗe ɗee, woto **winndu dokke kese e diski oo; ɗoon e ɗoon udditaa support.google.com/drive/gethelp (walla Google One yeewtere ballal) e ɗaɓɓude Rewtinnde Fiilde Mumtunde e Disko Njuɓɓudi. Kuutorɗe ballondiral Google ina mbaawi udditde balɗe 25 caggal nde mbaylaandi ndii waɗi ngam konte kuutortooɗe.
8. Bulk-Restoring Fiildeeji Binndaaɗi e Huutoraade Manage Versions walla API Diisnondiral Google (rclone / Piton):
9. Ngam Dokimaaji Google, Leppi, e Slides: Uddit fiilde ndee -> ɓuɗɗu File -> Version history -> See version history (Ctrl + Alt + Shift + H) e artirde limre waktu hanki.
10. Ngam fiilde binndol (PDF, DOCX, XLSX, JPG, ZIP) winndaa e nokku: Ɓoɗɗu e fiilde ndee e Google Drive -> File information -> Manage versions, ɗo Google jogori jogaade mbaydiiji ɓooyɗi fotde balɗe 30 (walla mbaydiiji 100).
11. So tawii ujunnaaje ujunnaaje fiilde binndol ina winndaa e nokku: Hoto ɓuuɓto Manage versions 000 laabi e junngo. Huutoro rclone walla Binndol kuutorɗe Google / API diisnondirɗo v3 revisions.list + revisions.delete binndol:
    • E nder Google Drive API v3, nde fiilngo gonngo ngoo winnditaa e mbaydi kesiri bonndi (Rewtinnde N), noddude Drive.Revisions.remove(fileId, latestRevisionId) momtata tan ko ƴeewndo toowngo bonngo ngo sosaa hannde, ina ɓamta otomatik ƴeewndo laaɓtungo hanki N - 1 warto ngam wonde fiilde jooni gollornde e nder denndaangal foldere:

      // Run inside script.google.com (with Advanced Drive Service v3 enabled) to roll back files modified after cutoffTime
      function rollbackOverwrittenFiles() {
        const cutoff = new Date("2026-11-01T00:00:00Z"); // Set to 5 minutes BEFORE the ransomware started
        const files = DriveApp.searchFiles('modifiedDate > "2026-11-01T00:00:00" and trashed = false');
        while (files.hasNext()) {
          const file = files.next();
          const revs = Drive.Revisions.list(file.getId()).revisions;
          if (revs && revs.length > 1) {
            const latest = revs[revs.length - 1];
            if (new Date(latest.modifiedTime) > cutoff) {
              Drive.Revisions.remove(file.getId(), latest.id);
            }
          }
        }
      }
      

12. Appel iCloud Drive (iCloud.com/recovery 30-Balɗe Ƴellitaare Doggi):
13. Hay so tawii fiiluuji ɗii njuumtaama e nder iCloud Drive, purgaama e nder... Recently Deleted foldere e Mac maa walla iPhone maa, naataa e icloud.com/recovery e nder feerorde web:
14. Ɓoɗɗu Restore Files -> ƴeewto Select All (walla filtirde e ñalngu momtungu) e ɓuɗɗude Restore. Serveur backend Apple ina jogii lowre ceertunde balɗe 30 ngam reentaade binndanɗe iCloud Drive momtaaɗe, foldere Desktop/Documents, Maandeeji, Jokkorɗe, e Kaalis.

Faandaare 3: Mooftude kaɓirɗe nokkuuje ɗe ngonaa e laylaytol ummoraade e kaɓirɗe ɗiɗmere e... Google DriveFS / Windows Shadow Copies¶

Ko adii nde njokkondirtaa e kala ordinateer e internet, ƴeewto so tawii diskiiji maa ina njogii haa jooni koppiiji fiiluuji maa ɗi bonnaaka :

Faandaare 4 : Porotokol jokkondire kisal (No ordinateeruuji laaɓtuɗi ngartirtee e internet tawa bonnaani ruulde ndee kadi)¶

Ina jeyaa e majjere ɓurnde heewde e ƴellitgol ruulde, caggal nde keɓ-ɗaa artirde piille maa e nder jokkorgal web ruulde : kuutortooɗo oo ina huɓɓa laptop mum, kiliyan sinkronisaasiyoŋ nokku oo ummotoo, yiytoo 20 000 .locked fiiluuji ransomware (walla foldereeji ɗi ngalaa hay huunde) jooɗiiɗi e diski nokku oo, e sinkronisaasiyoŋ bonɗo oo haa e diski ruulde keso oo.

Rewtu ndee doggol ƴeewndo tiiɗngol jokkondirde: 1. E dow ordinateer baɗɗo ɗum (Ransomware walla Script aksidaa): - So tawii Ransomware yanii e mum: Hoto meeɗ jokkondirde e oon jolngo OS e konte maa ruulde. Caggal nde ƴeewndo-ɗaa diisnondirɗo oo ngam ƴeewndaade walla hisnude kala fiilde nde alaa ɗo haaɗi, momtu SSD (Secure Erase / momtude denndaangal peccitagol) e laɓɓinde Windows walla macOS e nder ordinateer USB anndaaɗo-moƴƴo mahaaɗo e ordinateer ceertuɗo. - Waylu konte maa Google, Microsoft, Dropbox, e Apple e ƴeewndo Account Security -> Devices e Third-Party App Permissions ngam hoolkisaade hay kuukiiji jonnde infostealer keddii ina ngolloo. 2. E ordinateeruuji ɗiɗaɓiri hade maa udditde Wi-Fi: - So tawii aɗa artira cloud drive oo e ngonka laaɓka via Restore your OneDrive walla Dropbox Rewind: 1. Boot ordinateer ɗiɗaɓo e Wi-Fi haa jooni OFF. 2. Softin OneDrive / Dropbox / Google Drive nder Appuuji puɗɗagol (Task Manager -> Startup apps) ko ɗuum waɗi demon sinkronisaasiyoŋ oo waawaa udditaade otomatik. 3. Waylu innde nokku oo C:\Users\<Name>\OneDrive (walla Dropbox) foldere to OneDrive_OLD_LOCAL_BACKUP. 4. Uddit Wi-Fi, uddit app sinkronisaasiyoŋ ruulde, ɗaccu ɗum usta e jokkondirde e laaɓal, kadi ɗaccu ɗum ƴettude ngonka ruulde laaɓka keso artiraaka e nder foldere hesere.

3. Wartirde Windows Volume Shadow Copies (Previous Versions) e macOS APFS Nate nokkuuje e PC Source¶

Hol ko woni so tawii foldere sifirnde walla momtaande ina yaltinaa e sinkronisaasiyoŋ ruulde (hono nokkuure Desktop foldere walla fiilde ɓurnde mawnude e keerol sinkronisaasiyoŋ), walla kiliyan sinkronisaasiyoŋ duule oo timminaani neldude baylagol yontere ɓennunde ndee hade mum ustaade? 1. E nder windooji 10 / 11 (ShadowExplorer & vssadmin): - Nde wonnoo galleeji ransomware keewɗi ina njiɗi dogde vssadmin.exe delete shadows /all /quiet, Konte kuutortooɗo (UAC), Yiytude toɓɓere joofnirde e jaabawol (EDR), walla gollal ngal wonaa admin ina heewi haɗde wip koppi ɗoyngol. - Doggondirde e yamiroore hono njuɓɓudi e masiŋ keeriiɗo oo, winndu:

vssadmin list shadows

Naamne keewɗe naamneede¶

Mbele yoɓde njoɓdi desifiroowo fedde ransomaaji ina waɗi faayiida so tawii piille am ina sinkroniree e OneDrive, Dropbox, walla Google Drive ?¶

Fotde hay sahaa gooto. Nandugol e disko keeriiɗo mo alaa ballal, sarwisaaji mooftirɗi duule (Diisno gooto, Boks jolngo, Disko Google, Bojel, e Disko iCloud) mooftude piille e backends mooftirɗi geɗe ɗe mbaylaaka ɗo kala waylo-waylo sosata mbaydi geɗel kesol e kala momtugol ina nawta geɗel ngel e nder lowre mbaylaandi balɗe 30 (walla balɗe 93 haa 180). So tawii ransomware oo winnditii piille maa e nokku walla sosi ko keso .koɗki fiiluuji e momtude asliiji ɗii, 100 e nder teemedere piille maa asliije ɗe cifaaka ina njooɗii haa jooni e serweeji dokkoowo ruulde nder Daartol Ƴeewndo walla Trash. Huutoraade Wartir OneDrive maa, Dropbox Ƴeewndo, walla Google Drive Ɓooygol e Rewindaade ina artira piille maa laaɓtuɗe ko adii njiyaagu tawa aɗa yoɓa tawa alaa ko bonnata desifirooɓe ransomware bonɓe.

Hol ko waɗi ransomware e ordinateer am Windows ina waawi siifde Google Drive am walla OneDrive am e dumunna gadano oo ? Mbele ruulde ndee reenaaki e malware?¶

Ngam waɗde piille duule ina ngolloo e porogaraamuuji birooji baɗɗi Microsoft Word, Excel, Photoshop, e AutoCAD, kiliyaneeɓe sinkronisaasiyoŋ birooji (Google Disko ngam Desk, Diisno gooto.exe, Boks.exe) mooftude defterdu maa duule ko a foldere nokkuure walla alkulal diisnondiral (G:\ walla C:\Kuutortooɗo\Innde\OneDrive) les yamiroore kuutortooɗo Windows maa. So ransomware huutoriima les konte kuutortooɗo maa Windows, ina jogii yamiroore waylude fiilde nde mbaɗata ndee : ina yahra e kala alkulal diisnondirngal (C:\, D:\, G:\) e foldere kuutortooɗo, janngude kala fiilngo, siifde ɗum, e hisnude ɗum. Hay fiiluuji set to "E-Enternet-Tan / Fiildeeji Ɓooyɗi" (Fiildeeji E dow Ɗaɓɓaande) heɓde otomatik ("hydrated") e dow lewru e Windows kala nde golle ransomware udditi junngo fiilngo ngam janngude ɗum. Ko ɗum waɗi ittude lowre ndee ɗoon e ɗoon ina tiiɗi : ina taƴa ƴettugol hidraasiyoŋ (hydration) e dow ɗaɓɓaande (on-demand) e fiiluuji ruulde tan e nder internet hade ransomware janngude ɗi.

Hol ko woni so tawii mi momtii e aksidaa Folder Shared mawɗo e nder Google Drive walla Dropbox, tawa terɗe ekipaaji goɗɗi ina njogii yoga e piille nder mum?¶

E nder Boks jolngo, kala tergal jogiingal yamiroore waylude ina waawi huutoraade Fiildeeji mumtaaɗi walla Dropbox Ƴeewndo e dow foldere renndinde ngam artirde denndaangal njuɓɓudi foldere wonande kippu oo fof. E nder Disko Google, arsitektuur jeyi ko keeriiɗo : so a momtii lowre nder lowre Shared goɗɗo (ɗo ɓe woni Joom mum kadi ko a Editor), ittude fiilde ndee e doggol renndingol ngol yaayaaɓe fiilde ndee wonaa ustude ɗum ngam joom mum, walla diwde tan fiilde ndee aan jey e nder maa Ko mbuuɗu (diisnondirɗo.google.com/diisnondirɗo/ɓuuɓri) nde fiiluuji jeyaaɗi e gollodiiɗo maa ina naata maɓɓe Trash (walla wonta yatimɓe e root maɓɓe Drive njiylawu via woni:joom mum mo yuɓɓaani:miin e nder doggol njiylawu Google).

Mbele ransomware ina waawi momtude Daartol am mbaydi Cloud walla ustude mbaydi am OneDrive / Google Drive e hoore mum ?¶

Binndi ransomware njuɓɓudi fiilngo (Kokkol, Akira, Puccu ɓaleejo, Fijo, Fobos) golloraade tan ko e APIiji fiilngo Windows nokkuure (SosdeFiildeW, WinnduFiilde, MumtuFiildeW) e waawaa jokkondirde e web-tan Daartol mbaydi, Binndital ɗiɗaɓal, walla Kuutorgal njuɓɓudi nokku gollorde Google. Kono so tawii ñaawoowo oo kadi ƴettii an... wujjoowo kabaruuji (Lumma, Lawol Boɗewol) walla ina joginoo Desktop Remote jokkondirɗo (RDP / KalaBiro) naatde e feerorde maa udditiinde, ɓe mbaawa udditaade feerorde maa e junngo maɓɓe, ɓe ɓuuɓtoo Kosam ɗam alaa ko woni. Hay so ɓe mbaɗii, ciftoren backstops ɗiɗi cakkitiiɗi ɗii: (1) On OneDrive / Toɓɓere renndinde, geɗe ɗe ngalaa hay huunde njaha to... Binndital ɗiɗaɓal haa balɗe 93 ; e (2) On Disko Google / Nokku gollorɗo Google, geɗe mbuuɗu ɗe ngalaa ko ina keddii ina mbaawi heɓtineede e Admin nokku gollorɗo walla ballal Google One ngam Balɗe 25 caggal nde ɗum momtaa haa abada.

Ardiiɓe jokkondirɓe¶

• Ransomware e malware : seerndude e safrude ko yaawi
• Mumtugol fiilde tawa ko e aksidaa, disko mbaylaango, e heɓtude foto
• Fiilde Word, Excel, PDF, walla lowre domen bonnde e ƴellitgol binndanɗe ɗe ndesndaaka
• Backups ordinateeruuji : peeje 3-2-1 e reentaade musiiba
• Jaɓɓugol kuukiiji joɗnde, malware infostealer, e ittugol kuutorgal
• Limooje emergency e leydi

Fuɗɗoode e ardorde laawɗunde¶

• Ballal Microsoft laawɗungal (support.microsoft.com/en-us/office/restore-your-onedrive-fa231298-759d-41cf-bcd0-25ac53eb8a15): Wartir OneDrive maa (Histogram 30 balɗe toɓɓere-e-waktu, jeertinaali yiytugol Ransomware, e Ƴeewndo SharePoint e daawal gadanal/ɗiɗaɓal).
• Nokku ballal laawɗuɗo Dropbox (help.dropbox.com/delete-restore/rewind & recover-older-versions): Kuutoragol Dropbox Rewind ngam ittude ransomware walla mumtugol keewngol, daartol mbaydi balɗe 30 haa 180, e... .dropbox.cache Dingiral.
• Ballal njuɓɓudi nokku gollorɗo Google e binndanɗe laawɗuɗe Google Drive (support.google.com/a/answer/6052340 & developers.google.com/drive/api/reference/rest/v3/revisions): Wartirde Dokke Google Drive momtaaɗe haa abada e nder balɗe 25 rewrude e Konsol Admin e API Drive v3 revisions Njuɓɓudi.
• Waɗde kisal siber e kisal gollorɗe (CISA / StopRansomware.gov): Sinkronisaasiyoŋ mooftirgel ruulde seerndude e ƴellitde mbaydi caggal ransomware golle ɓurɗe moƴƴude.