2

Let's say there is a particular network which has a "monthly" successful cryptolocker attack. Every time, every computer in that network is infected.

The set up is like this:

  • 1x Windows 2003 server (SMB1)
  • 4x Windows 10 Client computers

Every time, the server and 3x Windows 10 machines are infected. 1 machine remains unaffected.

They are all part of the same domain.

Is it possible, that a virus infection resides on that one computer that never gets infected, and spreads the crypto onto the other machines without infecting it's host? Has anyone experiences likewise behavior?

Improve this question
1
  • 2
    The machine that is spreading the virus in this scenario would be infected, it would just not be encrypted. And yes, this is theorethically possible. Does it happend in practice? I have no idea.
    – Anders
    May 23, 2019 at 19:09

2 Answers 2

Reset to default
3

The concept you are looking for is "persistence". You don't want to destroy your route to continue to extort the victim.

If you encrypt the machine that is your route in, then the victim will reformat/reinstall the operating system and wipe out your route in.

So, you leave the one machine (likely the first infected machine) alone, but launch attacks from it to the rest of the network.

Improve this answer
0

I don't see how it is possible for a virus to spread from a computer that is not infected. With that in mind, security updates for Windows server 2003 stopped in 2015. Since that date, a number of vulnerabilities have been identified:

https://www.cvedetails.com/product/7108/Microsoft-Windows-Server-2003.html?vendor_id=26

This could leave the machine wide open to automated attacks.

This vulnerability is oddly consistent with the configuration you are describing:

https://www.cvedetails.com/cve/CVE-2017-0176/

Improve this answer
1
  • In this scenario the computer would be infected (or compromised at least), the attackers would have just left it in such a state so that it seemed untouched so that no one would bother wiping/restoring it, thus persisting the attack. It's certainly possible: whether or not it happens is another matter.
    – Conor Mancone
    Sep 14, 2020 at 23:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .