Written by the Nostra team · Reviewed October 2026
Classic ransomware encrypted file servers. Modern operators go where the business lives: they phish a Microsoft 365 identity, quietly sync SharePoint and OneDrive, exfiltrate what's valuable, then encrypt endpoints and cloud files together — and delete what passes for backups. That's why identity, email, endpoint and backup can't be treated as separate problems.
Most 365 compromises start with a stolen sign-in. Multi-factor authentication stops the overwhelming majority of them, and conditional access finishes the job: block legacy authentication, challenge risky sign-ins, restrict access from unmanaged devices. If you do one thing this quarter, make it MFA with no exceptions — including the accounts everyone forgets, like shared mailboxes and break-glass admins.
Email is the delivery mechanism: Safe Links, Safe Attachments and impersonation protection (plus a second filtering layer for the attacks Microsoft misses) cut what reaches the inbox. Endpoints are the detonation site: EDR that detects encryption behaviour in real time and isolates the device from the network automatically turns a company-wide incident into a one-laptop inconvenience.
Assume everything above fails once. Recovery then depends entirely on backup that ransomware can't reach: continuous backup of Exchange, SharePoint, OneDrive and Teams held outside Microsoft, with immutable copies that can't be altered or deleted — even by an admin account the attacker now controls. And test restores on a schedule; a backup proven by a green tick but never restored is a hope, not a plan.
Every tool above raises signals. At 2am on a Saturday, signals need humans: a 24/7 SOC that triages the alert, isolates the device, kills the session and starts recovery while the attack is minutes old. This full stack — identity hardening, email and endpoint defence, immutable 365 backup, automatic isolation and a round-the-clock SOC — is precisely what Nostra packages as Cloud Shield 365, protecting 160+ organisations today.
Written by the Nostra team | Reviewed October 2026
Yes — via a compromised identity or a synced device, attackers can mass-encrypt or delete cloud files, and versioning alone is not reliable protection against a determined operator.
Payment funds the next attack, frequently fails to recover everything, and may create legal exposure. Organisations with immutable, tested backups don't face the question.
Modern ransomware moves from first access to encryption in hours. Detection-to-isolation in minutes is the difference between an incident report and a closure notice — which is why 24/7 human response matters.
Thirty minutes with a Nostra specialist answers more than an afternoon of reading.
Book a 30-minute conversation