Ransomware (Globe Imposter) was found on one of our production servers.

The executable was found in the documents folder of one of our employees on the same server. A Windows Scheduled Task was also created using the same employee's domain account.

Would it be possible for the ransomware to impersonate the employee? Or did the employee execute it accidentally?


We found ransomware on the production server which was executed using a scheduled task by a specific user. I'm asking if he executed it or if it's possible for something to impersonate him.

Tl;dr: To answer this in one line - yes. It's perfectly possible for a script to have masqueraded as him.

It might, for example, have keylogged his domain login and then used the password to execute scripts with administrative privileges.

But to be absolutely sure, you'd have to take his system and examine it to see how the malware works - check what it sought out to do, and don't rule out the possibility that it could be an internal attack.

  • Piggybacking here for some policy advice - OP, keep in mind that if the employee did NOT act maliciously, and was instead just duped, he just got some very effective free training in how to not get duped. I'd hesitate to do anything beyond sending him to some mandatory cyber security training. He's probably the person least likely to get hoodwinked now. Obviously if he maliciously ran the virus then it's a different story. I see the implication of "what to do" in your original question, so apologies if I'm off base here. – Adonalsium Dec 22 '17 at 13:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.