We have been attacked by the ransomware recently (adobe li). The strange thing is that ransomware was able to gain unimaginable high privileges. The virus of the ransomware has been located on the computer of the ordinary user. I can not imagine how it was able to overcome two obstacles:
- The ransomware should have been started by some user explicitly. So - why the antivirus software (built in Windows 10 Defender) did not issued warning to the user that user is starting uncertified software.
- This ransomware encrypted not only the local files of this computer but it followed all the available Windows and Linux shares, it attacked even the shares which required the privileges of the administrator or other users to write into those shares.
So - if antivirus does not prevent the running of the ransomware and if the ransomware is able to write into the shares writable by administrator only, then something is really, really wrong with the most basic security infrastructure of the contemporary computers. What countermeasure can we take against such ransomware's ability to access privileged places on the network?