Let's say there is a particular network which has a "monthly" successful cryptolocker attack. Every time, every computer in that network is infected.
The set up is like this:
- 1x Windows 2003 server (SMB1)
- 4x Windows 10 Client computers
Every time, the server and 3x Windows 10 machines are infected. 1 machine remains unaffected.
They are all part of the same domain.
Is it possible, that a virus infection resides on that one computer that never gets infected, and spreads the crypto onto the other machines without infecting it's host? Has anyone experiences likewise behavior?