Google Drive Enhances Ransomware Protection with AI Detection and Recovery Tools

Severity: Low (Score: 30.9)

Sources: Neowin, Techtimes, Cybersecuritynews, Feeds2.Feedburner, Androidauthority

Summary

Google Drive has officially launched its ransomware detection and file restoration features, which were in beta since September 2025. The upgraded AI model can now detect up to 14 times more ransomware-related behavior than previous versions. When suspicious activity is detected, Google Drive automatically pauses file syncing to prevent the spread of infected files. Users receive real-time alerts, and admins are notified if they are part of an organization. The recovery tool allows users to restore files to a previous clean version, minimizing downtime and the need for external backups. While the file restoration feature is available to all users, ransomware detection is limited to specific Google Workspace tiers. This update aims to bolster security for both individual users and organizations relying on cloud collaboration. The new features are enabled by default for users running Google Drive version 114 or later. Key Points: • Google Drive's ransomware detection can identify 14 times more threats than before. • Automatic file syncing pauses when suspicious activity is detected to limit damage. • File restoration tools allow users to revert to clean versions of affected files.

Key Entities

• Malware (attack_type)
• Ransomware (attack_type)
• T1486 - Data Encrypted for Impact (mitre_attack)
• Android (platform)
• Google Workspace (platform)
• Google Drive (tool)