A system comprising: one or more hardware processors; and a memory storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising: receiving, at a cloud storage server, a request from a client device to store a file at the cloud storage server wherein the file includes a modified file of an original server-stored file in a data structure in the cloud storage server, the data structure associated with the client device registered with the cloud storage server; storing the file in a storage device of the cloud storage server wherein storing the file includes modifying the original server-stored file to generate a modified server-stored file; determining features of the modified server-stored file; determining whether the modified server-stored file stored at the cloud storage server is impacted by ransomware by detecting ransomware activity based on the features of the modified server-stored file; generating a notification to the client device in response to detecting the ransomware activity, the notification indicating a presence of the ransomware activity in the modified server-stored file, the notification including a request to confirm the presence of the ransomware activity in the modified server-stored file; receiving, from the client device, a ransomware confirmation in response to the notification, the ransomware confirmation indicating a confirmation of the presence or an absence of the ransomware activity in the modified server-stored file; and updating an operation of the detection of the ransomware activity based on the received ransomware confirmation. one or more hardware processors; and a memory storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising: receiving, at a cloud storage server, a request from a client device to store a file at the cloud storage server wherein the file includes a modified file of an original server-stored file in a data structure in the cloud storage server, the data structure associated with the client device registered with the cloud storage server; storing the file in a storage device of the cloud storage server wherein storing the file includes modifying the original server-stored file to generate a modified server-stored file; determining features of the modified server-stored file; determining whether the modified server-stored file stored at the cloud storage server is impacted by ransomware by detecting ransomware activity based on the features of the modified server-stored file; generating a notification to the client device in response to detecting the ransomware activity, the notification indicating a presence of the ransomware activity in the modified server-stored file, the notification including a request to confirm the presence of the ransomware activity in the modified server-stored file; receiving, from the client device, a ransomware confirmation in response to the notification, the ransomware confirmation indicating a confirmation of the presence or an absence of the ransomware activity in the modified server-stored file; and updating an operation of the detection of the ransomware activity based on the received ransomware confirmation. receiving, at a cloud storage server, a request from a client device to store a file at the cloud storage server wherein the file includes a modified file of an original server-stored file in a data structure in the cloud storage server, the data structure associated with the client device registered with the cloud storage server; storing the file in a storage device of the cloud storage server wherein storing the file includes modifying the original server-stored file to generate a modified server-stored file; determining features of the modified server-stored file; determining whether the modified server-stored file stored at the cloud storage server is impacted by ransomware by detecting ransomware activity based on the features of the modified server-stored file; generating a notification to the client device in response to detecting the ransomware activity, the notification indicating a presence of the ransomware activity in the modified server-stored file, the notification including a request to confirm the presence of the ransomware activity in the modified server-stored file; receiving, from the client device, a ransomware confirmation in response to the notification, the ransomware confirmation indicating a confirmation of the presence or an absence of the ransomware activity in the modified server-stored file; and updating an operation of the detection of the ransomware activity based on the received ransomware confirmation.