Cloud-native global file system with rapid ransomware recovery

An apparatus to configure and manage storage for an enterprise, comprising:

• one or more hardware processors;
• computer memory associated with each hardware processor to hold computer software executed by the hardware processor, wherein the computer software comprises:
• first computer software configured to receive input data to provision and manage a scalable file system across storage resources associated with at least one cloud-based storage provider, wherein the input data defines a volume, and one or more attributes associated with the volume, wherein the volume is a logical construct representing a point of indirection separating the scalable file system from the storage resources;
• second computer software configured as a filer to represent, to the enterprise, a local file system whose inode structure and data are stored as a version in the storage resources in a write-once, read-many manner;
• third computer software configured to detect a ransomware attack;
• and
• fourth computer software configured to respond to detection of the ransomware attack to restrict access to the volume, activate or designate an instance of a recovery filer, initiate a restore operation at the recovery filer, create a new clean snapshot of the the volume using the recovery filer upon completion of the restore operation, and re-enable access to the volume.