Ransomware constitutes a form of malicious software designed to impede users’ access to their systems, either by locking the system’s screen or restricting access to files until a ransom is paid. In corporate settings, user computers typically store system and program files, with document access occurring through shared servers. In such instances, a single crypto-ransomware infected host can potentially block access to all shared files within its reach, encompassing the entire file set of a user workgroup. To address this issue, we propose implementing a machine-learning model to identify crypto-ransomware activity by analyzing file-sharing traffic. This framework actively monitors the traffic exchanged between clients and file servers, employing machine learning techniques to discern patterns indicative of ransomware actions, particularly during the reading and overwriting of files. Notably, the model is designed to operate not only for clear text protocols but also for encrypted file-sharing protocols. The model’s efficacy is validated through an extensive dataset comprising over 70 ransomware binaries from 33 strains and more than 2,400 h of ‘uninfected’ traffic from actual users.