Can ransomware hide in cloud storage/backup environments?

Question

I currently use Dropbox as an online backup to protect my important files (work related, save files, some hobby projects) against data loss, including ransomware, hardware loss, theft,...

However, I'm wondering whether this might actually cause more issues in some situations. Suppose I get infected by ransomware. Not much lost, I just reinstall Windows and rollback my Dropbox to before I got infected (maybe through an account rollback ticket). However, could the ransomware somehow manage to hide itself in my Dropbox folder and reinfect my machine after the rollback, or worse, other machines that sync using Dropbox?

Example: I got my resumé in my dropbox. Can ransomware alter this word file so it can reinfect me? And would this alteration survive a Dropbox rollback to a point before I got infected?

Answer 1

Probably not... but yes it can.

There are many places: Exe files, MSI, PDF, Word files (Macros) I would recommend you to inspect all files with a Virus Scanner and/or a tool that detects the exact Ransomware you have just removed...

In general you should avoid storing some files in your backups (like .EXE or .MSI)

For example:

1. Ransomware owns your system
2. Ransomware detects dropbox and infects your cv or .exe with trojan or another version of himself
3. Ransomware encrypt your files and delete originals from your harddrive and dropbox
4. You get rid of ransomware and restore previous version of dropbox files
5. Previous version was infected in step 2 (smart ransomware developer)
6. Back to square 1