If the cybercriminal succeeded in gaining a foothold in the company's network, why are the whole network and other computers infected with ransomware except the one on which he gained a foothold?
Add a comment
|
2 Answers
Because if you kill the computer that is giving you access to the network, you lose your doorway into that network and your control over that network.
In English, there is an expression about "cutting off the branch you're sitting on". It's the idea that you shouldn't damage the thing that is supporting you. I'm sure other languages have similar expressions.
answered Feb 26, 2023 at 21:34
-
1I don't know why you edited my question, when this question that is edited now is not question that I asked and this is reason why I hate Stackexchange. My original question was (and is) as I asked: How hacker/hacking groups manage to infect all computers and not just computer on which they have foothold? Is there some centralized computer in network (Active Directory I guess?) that is controlling other computers in network so when he is infected ransomware is spread? You answered on question "why computer with foothold in network doesn't get ransomwared" which I didn't ask at all.– pegasusCommented Feb 26, 2023 at 22:18
-
No, that's not what you asked. You asked something else, which was difficult to understand.– schroeder ♦Commented Feb 27, 2023 at 8:50
-
I'm sure that you have a clear understanding of what you want to ask, but your phrasing makes it difficult to understand. So, you want to know the technical details about how ransomware can avoid the one crucial computer that is giving the attacker access? And why ransomware doesn't infect all machines equally?– schroeder ♦Commented Feb 27, 2023 at 8:53
-
If a cybercriminal is taking over a Domain Controller (Active Directory network), he can then execute a program on the whole network using tools such as wmic. You can find a good example here: thedfirreport.com/2022/04/25/quantum-ransomware– LuhkoCommented Feb 27, 2023 at 13:10
-
@pegasus are you simply asking how viruses spread? If that's what you are asking, have you looked that up? There are hundreds of articles over decades explaining how viruses spread, in general, and just as many explaining step-by-step how modern ransomware spreads.– schroeder ♦Commented Feb 27, 2023 at 23:36
The stated question is already answered by @schroeder.
However, if your question was actually something like "someone breaks into a computer, that is part of a network. How does that person infect every other computer in the network with ransomware" (as you suggest in your comment), then the answer is that it depends on several factors, such as the network topology, setup etc
The process of gaining access to a computer is well understood - a penetrator finds a vulnerability, exploits it and gains access. If the penetrator wants to use ransomware, then this process can be done manually (gain access to each computer and infect it with the ransomware) or in an automated way (by e.g. using a worm that will exploit vulnerabilities and deliver the ransomware as its payload).
I hope that this clarifies things, as well.