OneDrive ransomware

ThreatLocker researchers demonstrate “DoubleDrive,” a ransomware technique that leverages OneDrive synchronization and junction manipulation to delete local files, replicate them to OneDrive, and encrypt them—thereby disabling local recovery. The report identifies vulnerable OneDrive client versions, provides a timed demonstration of developing and deploying a malicious executable, and recommends application allowlisting and ringfencing as mitigations.