1

We have been attacked by the ransomware recently (adobe li). The strange thing is that ransomware was able to gain unimaginable high privileges. The virus of the ransomware has been located on the computer of the ordinary user. I can not imagine how it was able to overcome two obstacles:

  1. The ransomware should have been started by some user explicitly. So - why the antivirus software (built in Windows 10 Defender) did not issued warning to the user that user is starting uncertified software.
  2. This ransomware encrypted not only the local files of this computer but it followed all the available Windows and Linux shares, it attacked even the shares which required the privileges of the administrator or other users to write into those shares.

So - if antivirus does not prevent the running of the ransomware and if the ransomware is able to write into the shares writable by administrator only, then something is really, really wrong with the most basic security infrastructure of the contemporary computers. What countermeasure can we take against such ransomware's ability to access privileged places on the network?

  • Are you sure that no one purposefully installed the ransomware and ran it as administrator? – CoderPE Dec 14 '18 at 23:05
  • Where "purposefully" usually means "thought it was a legitimate, safe, program", not "intended to cause the company harm". – Clockwork-Muse Dec 15 '18 at 7:37
  • 1
    Privilege Escalation is often tried by malware. Due to errors in the operating system, drivers or privileged software a malicious actor might have gained access to higher privilege mode. This can have many reasons. Including mundane reasons like sysadmin clicking on sexyladies.exe. It's very hard to pin point where this happened. Do you have any information on what malware has infected you? – BlueWizard Dec 15 '18 at 20:18
  • I am not told the exact exe name yet. But I know that the virus has been found on the computer of the user who definitely has no administrator rights and this user certainly is reliable and knowledgeable user without bad intentions. – TomR Dec 15 '18 at 21:39
  • @TomR It's not because it was found on the user's machine that it originated from there. Might be your malware already obtained privileges somewhere else and is performing lateral movement. But then the rest of your network should be affected too. When was the last time you patched your machines? – Lucas Kauffman Dec 17 '18 at 1:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.