Mitigate ransomware attacks using Google Cloud

Last reviewed 2025-05-30 UTC

Code created by a third party to infiltrate your systems to hijack, encrypt, and steal data is referred to as ransomware. To help you mitigate ransomware attacks, Google Cloud provides you with controls for identifying, protecting, detecting, responding, and recovering from attacks. These controls help you accomplish the following:

  • Assess your risk.
  • Protect your business from threats.
  • Maintain continuous operations.
  • Enable rapid response and recovery.

This document is intended for security architects and administrators. It describes the ransomware attack sequence and how Google Cloud can help your organization mitigate the effects of ransomware attacks.

Ransomware attack sequence

Ransomware attacks can start as mass campaigns looking for potential vulnerabilities or as directed campaigns. A directed campaign starts with identification and reconnaissance, where an attacker determines which organizations are vulnerable and what attack vector to use.

There are many ransomware attack vectors. The most common vectors are phishing emails with malicious URLs or exploiting an exposed software vulnerability. This software vulnerability can be in the software that your organization uses, or a vulnerability that exists in your software supply chain. Ransomware attackers target organizations, their supply chain, and their customers.

When the initial attack is successful, the ransomware installs itself and contacts the command and control server to retrieve the encryption keys. As ransomware spreads throughout the network, it can infect resources, encrypt data using the keys that it retrieved, and exfiltrate data. Attackers demand a ransom, typically in cryptocoins, from the organization so that they can get the decryption key.

The following diagram summarizes the typical ransomware attack sequence explained in the previous paragraphs, from identification and reconnaissance to data exfiltration and ransom demand.

The ransomware attack sequence.

Ransomware is often difficult to detect. It's critical, therefore, that you put in place prevention, monitoring, and detection capabilities, and that your organization is ready to respond swiftly when someone discovers an attack.

Security and resiliency controls in Google Cloud

Google Cloud includes built-in security and resiliency controls to help protect customers against ransomware attacks. These controls include the following:

  • Global infrastructure designed with security throughout the information-processing lifecycle.
  • Built-in detective features for Google Cloud products and services, such as monitoring, threat detection, data loss prevention, and access controls.
  • Built-in preventive controls, such as Assured Workloads
  • High availability with regional clusters and global load balancers.
  • Built-in backup, with scalable services.
  • Automation capabilities using Infrastructure as Code and configuration guardrails.

Google Threat Intelligence, VirusTotal, and Mandiant Digital Threat Monitoring track and respond to many types of malware, including ransomware, across Google infrastructure and products. Google Threat Intelligence is a team of threat researchers that develop threat intelligence for Google Cloud products. VirusTotal is a malware database and visualization solution that provides you with a better understanding of how malware operates within your enterprise. Mandiant Digital Threat Monitoring and other Mandiant services provide threat research, consultation, and incident response support.

For more information about built-in security controls, see the Google security overview and Google infrastructure security design overview.

Security and resiliency controls in Google Workspace, Chrome browser, and Chromebooks

In addition to the controls within Google Cloud, other Google products like Google Workspace, Google Chrome browser, and Chromebooks include security controls that can help protect your organization against ransomware attacks. For example, Google products provide security controls that allow remote workers to access resources from anywhere, based on their identity and context (such as location or IP address).

As described in the Ransomware attack sequence section, email is a key vector for many ransomware attacks. It can be exploited to phish credentials for fraudulent network access and to distribute ransomware binaries directly. Advanced phishing and malware protection in Gmail provides controls to quarantine emails, defends against dangerous attachment types, and helps protect users from inbound spoofing emails. Security Sandbox is designed to detect the presence of previously unknown malware in attachments.

Chrome browser includes Google Safe Browsing, which is designed to provide warnings to users when they attempt to access an infected or malicious site. Sandboxes and site isolation help protect against the spread of malicious code within different processes on the same tab. Password protection is designed to provide alerts when a corporate password is being used on a personal account, and checks whether any of the user's saved passwords have been compromised in an online breach. In this scenario, the browser prompts the user to change their password.

The following Chromebook features help to protect against phishing and ransomware attacks:

  • Read-only operating system (Chrome OS). This system is designed to update constantly and invisibly. Chrome OS helps protect against the most recent vulnerabilities and includes controls that ensure that applications and extensions can't modify it.
  • Sandboxing. Each application runs in an isolated environment, so one harmful application can't easily infect other applications.
  • Verified boot. While the Chromebook is booting, it is designed to check that the system hasn't been modified.
  • Safe Browsing. Chrome periodically downloads the most recent Safe Browsing list of unsafe sites. It is designed to check the URLs of each site that a user visits and checks each file that a user downloads against this list.
  • Google security chips. These chips help protect the operating system from malicious tampering.

To help reduce your organization's attack surface, consider Chromebooks for users who work primarily in a browser.

Best practices for mitigating ransomware attacks on Google Cloud

To protect your enterprise resources and data from ransomware attacks, you must put multi-layered controls in place across your on-premises and cloud environments.

The following sections describe best practices to help your organization identify, prevent, detect, and respond to ransomware attacks on Google Cloud.

Identify your risks and assets

Consider the following best practices to identify your risks and assets in Google Cloud:

Control access to your resources and data

Consider the following best practices to limit access to Google Cloud resources and data:

Protect critical data

Consider the following best practices to help protect your sensitive data:

Secure network and infrastructure

Consider the following best practices to secure your network and infrastructure:

Protect your workloads

Consider the following best practices to help protect your workloads:

Detect attacks

Consider the following best practices to help you detect attacks:

Plan for incidents

  • Complete business continuity and disaster recovery plans.

  • Create a ransomware incident response playbook, and perform tabletop exercises. Regularly practice recovery procedures to ensure readiness and identify gaps.

  • Understand your obligations for reporting attacks to authorities and include relevant contact information in your playbook.

For more security best practices, see Well-Architected Framework: Security, privacy, and compliance pillar.

Respond to and recover from attacks

When you detect a ransomware attack, activate your incident response plan. After you confirm that the incident isn't a false positive and that it affects your Google Cloud services, open a P1 support case. Cloud Customer Care responds as documented in the Google Cloud: Technical Support Services Guidelines.

After you activate your plan, gather the team within your organization that needs to be involved in your incident coordination and resolution processes. Ensure that these tools and processes are in place to investigate and resolve the incident.

Follow your incident response plan to remove the ransomware and restore your environment to a healthy state. Depending on the severity of the attack and the security controls that you have enabled, your plan can include activities such as the following:

  • Quarantining infected systems.
  • Restoring from healthy backups.
  • Restoring your infrastructure to a previously known good state using your CI/CD pipeline.
  • Verifying that the vulnerability was removed.
  • Patching all systems that might be vulnerable to a similar attack.
  • Implementing the controls that you require to avoid a similar attack.

As you progress through your response process, continue to monitor your Google support ticket. Cloud Customer Care takes appropriate actions within Google Cloud to contain, eradicate, and (if possible) recover your environment.

Inform Cloud Customer Care when your incident is resolved and your environment is restored. If one is scheduled, participate in a joint retrospective with your Google representative.

Ensure that you capture any lessons learned from the incident, and set in place the controls that you require to avoid a similar attack. Depending on the nature of the attack, you could consider the following actions:

  • Write detection rules and alerts that would automatically trigger should the attack occur again.
  • Update your incident response playbook to include any lessons learned.
  • Improve your security posture based on your retrospective findings.

What's next