Does Dropbox protect against ransomware?

Not in the sense of stopping an infection. Dropbox's own recovery documentation treats ransomware as something that already happened to your files, not something it screens out: when malware encrypts files on a synced device, the encrypted versions sync to Dropbox and to every other linked device like any other change. What Dropbox offers instead is recovery — version history for individual files, and Dropbox Rewind to roll back an entire account or folder at once — but Rewind is 'only available to customers on paid Dropbox plans,' so free Dropbox Basic users get the shortest recovery window and no Rewind at all.

Dropbox's own recovery instructions make the sync mechanics plain, even though the page never uses the word 'spread.' Its guide to what to do if your files were corrupted or renamed by ransomware tells you to remotely log out of your devices, explaining that '[i]f you don't know which device is infected, you can remotely log out of every device' — advice that only makes sense because an infection on one synced device can reach every other device linked to the account. The same page's cleanup steps describe what that sync did to the files themselves: after restoring, it tells you to '[d]elete the Dropbox folder with the previously encrypted files,' because 'when you log back in on your device, you'll download the recovered files from Dropbox instead of the encrypted ones.' In other words, the encrypted files were themselves synced up to Dropbox and back down to your device like any other edit, not detected and blocked on the way up.

The recovery route itself is, in Dropbox's words, a choice between two tools depending on scale. For a single file, the guide says to go to the file's version history page and '[s]elect a version of the file before the ransomware took effect,' then restore it. For a larger incident, it points to the bigger tool: '[t]he easiest way to do so is to use Dropbox Rewind to take your entire account or an entire folder back to a point in time before the ransomware occurred.' Both tools are bounded by the same underlying clock — Dropbox's Rewind documentation states plainly that 'Dropbox Rewind can only undo changes made within your account's version history' — and the recovery guide is direct about who gets access to the bigger tool at all: 'Dropbox Rewind is only available to customers on paid Dropbox plans.'

That plan line is not a minor footnote — it's the whole asymmetry. Dropbox's version-history overview page sets the recovery window by tier: 'Dropbox Basic, Plus, and Family customers have 30 days. Dropbox Professional, Essentials, Business, and Standard customers have 180 days. Dropbox Business Plus, Advanced, and Enterprise customers have 365 days.' Rewind itself is scoped even more narrowly than that 30-day floor suggests: its own help page lists the feature as available 'to users on the Dropbox Backup plan, or Dropbox Plus, Family, Professional, Essentials, Standard, Advanced, Business, Business Plus, or Enterprise' — Dropbox Basic is not on that list, so a free-tier user gets the shortest version-history window (30 days) and no Rewind tool to use it with, only the slower, file-by-file version-history restore. Detection of a suspected attack is gated further still: Dropbox states that '[r]ansomware detection is available to teams on Dropbox Standard or Business who have purchased the Security add-on, and to teams on Dropbox Business Plus, Advanced or Enterprise' — an admin-console alert that individual Basic, Plus, Family, Professional, and Essentials users don't get at all, paid or not.

Recovery tools address one direction of the problem — getting files back after an attack — but this archive separately documents Dropbox itself functioning as infrastructure malware rides on. The AsyncRAT campaign this archive catalogs used ordinary Dropbox share links as the first hop in a multi-stage infection chain, letting a malicious download sail past filters that trust the dropbox.com domain before the real payload arrived via a temporary TryCloudflare tunnel several stages later. Separately, state-aligned hacking groups including North Korea's Kimsuky and ScarCruft have repeatedly used the Dropbox API itself as a command-and-control and data-exfiltration channel, authenticating with attacker-controlled tokens and blending their traffic into ordinary, trusted Dropbox activity — the same technique behind Worok's 2022 DropBoxControl espionage tooling, and one that researcher Jake Williams demonstrated as a proof of concept as far back as 2013 with DropSmack, using the Dropbox sync folder itself to move commands and stolen files past a corporate firewall. None of that is a flaw in Dropbox's recovery tools; it's a separate, documented way the same trusted, always-syncing plumbing gets turned against users and the organizations that rely on it.

For the fuller record behind those campaigns, see this archive's entries on the AsyncRAT Dropbox-links campaign, Dropbox API abuse as APT command-and-control, Worok's DropBoxControl, and DropSmack, alongside the separate 2024 wave of phishing pages hosted directly on Dropbox. And for how long a deleted or overwritten file actually stays recoverable outside a ransomware scenario, see this archive's answer at /questions/how-long-does-dropbox-keep-deleted-files rather than treating the recovery windows above as the full picture.