Can ransomware infect cloud storage?

Yes. Cloud storage such as Amazon S3, Azure Blob Storage, and cloud file shares can be encrypted or corrupted, often through compromised credentials rather than malware on an endpoint. In the January 2025 Codefinger attacks, for example, attackers used stolen AWS keys to encrypt S3 data with the cloud provider’s own server-side encryption — no ransomware binary required.

The shared-responsibility model means securing data in the cloud is the customer’s job. Elastio hunts inside live and replicated cloud data, detecting corruption regardless of whether it came from malware, an insider, or stolen credentials.