Is it possible that ransomware attacks only mapped drives and not the local drive?


This is entirely possible, although it would be a bit too specific for most ransomware out there unless it's targeting specific organizations that are known to use mapped network drives. It'd be more useful for the attacker to target both local and network drives if the aim is ransoming as much data as possible.

Ransomware is software, so it can be written to target anything it wants that other software is capable of using.


The goal of ransomware is to make money. The programmers do what they can to maximise the money they can make. So, it makes sense for ransomware to check if the infected device is connected to mapped drives. If it is, then it is likely part of a business, and it is more profitable to encrypt the shared business files and demand ransom from the business instead of encrypting the local files, which limits the impact. An infected machine can be isolated and contained. the shared files on a mapped drive are far more difficult to isolate and contain. The goal is maximum reach with maximum impact so that the business is more likely to pay the ransom.

The other reason to leave the local drive alone is that the machine's anti-virus might pick up the encrypting activity even if it did not detect the infection. But many businesses do not run anti-virus on the file servers (because of the performance hit). So the ransomware can remain hidden for longer to increase its impact.

If there are no mapped drives, the ransomware can look to the local drive to demand ransom of the user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.