Ransomware (Globe Imposter) was found on one of our production servers.
The executable was found in the documents folder of one of our employees on the same server. A Windows Scheduled Task was also created using the same employee's domain account.
Would it be possible for the ransomware to impersonate the employee? Or did the employee execute it accidentally?