Re:A Hidden Cost of Ransomware: Wholesale Password Theft
by michaelt on Thursday January 09, 2020 @06:18AM
(#22000231)
You get a much bigger ransom for encrypting the list of customers who haven't paid yet, which is critical for the company to stay in business, than by encrypting the OS and software that could just be reinstalled. [1]
And if the company has everyone save their work on a shared network drive that lots of users have write access to, you don't even need to spread to other computers.
Plus of course, there are the classic means of spreading within a network - scan machines on the network for vulnerabilities, infect anything executable on shared drives, phishing e-mails that genuinely come from another employee's computer, keylog or brute force an admin password....
And if the company has everyone save their work on a shared network drive that lots of users have write access to, you don't even need to spread to other computers.
Plus of course, there are the classic means of spreading within a network - scan machines on the network for vulnerabilities, infect anything executable on shared drives, phishing e-mails that genuinely come from another employee's computer, keylog or brute force an admin password....
[1] https://xkcd.com/1200/