How Ransomware Spreads Through a Business
KEEPING SAVANNAH MOVING · INVESTIGATION 3 OF 8
A dispatch laptop is one computer. Dispatching is a business process that may depend on shared files, customer records, identity services and several other computers. When an attacker gains access to the laptop, the consequential question is how much of that wider process the intruder can reach.
In Part 1, we examined the unnamed maritime facility affected by Ryuk. The Coast Guard bulletin suspected phishing and documented operational disruption, but did not publish the complete intrusion path. The Savannah freight scenario below is hypothetical; the technical behaviors come from broader guidance and threat research.
The first opening is only the beginning
Imagine a small freight company whose dispatcher receives a convincing request to review changed delivery paperwork. In this scenario, the employee enters a password into a fraudulent sign-in page, giving an attacker an opening into the business. Elsewhere, an opening might involve vulnerable remote-access software or a compromised vendor account. The point of examining the opening is to understand what the company has allowed that access to do.
Start with the dispatcher’s legitimate job. The employee needs shipment instructions and customer communications. Does that role also need the ability to install software, administer other computers or change backup settings? Every unnecessary permission gives a stolen account more value. An access review should describe the work an employee must accomplish and then check the permissions against that description.
When an ordinary account becomes a powerful account
Continue the hypothetical incident. The attacker initially sees the dispatcher’s files and applications. Now suppose an administrator has used a broadly privileged account on the same workstation and the attacker manages to compromise that account too. The situation changes: the attacker can attempt actions the dispatcher could never perform. This increase in authority is what security professionals mean by gaining privileges.
For the owner, the practical issue is concentration of power. If the same account can manage laptops, servers and backup storage, its compromise can threaten all three. Separate routine work from administration, and ask who can authorize changes to the most important systems. A convenient all-purpose login can conceal a business dependency until the day it is lost.
How access reaches the next system
MITRE’s Ryuk profile documents use of stolen domain-administrator accounts and Windows administrative shares to move between systems. These are observations across reported Ryuk activity, not a fixed sequence that every attack follows. Lateral movement means expanding access from an initial system to other systems.
In our freight company, the compromised workstation can communicate with the dispatch server, an office file share and a warehouse management interface. Those connections may have accumulated as staff and suppliers solved individual support problems. Nobody intended to create a route through the whole company; nevertheless, the route exists.
Draw the required connections with the person who maintains the network. A dispatcher might need to use the dispatch application without needing access to its administration console. A warehouse vendor might need one maintenance connection without needing every office computer. Each connection should have a business purpose, an owner and a defined set of permitted users or services.
Protect the route back to work
Now add the backup system to that drawing. If our hypothetical attacker’s account can delete the live shipment records and their recovery copies, the company has concentrated another critical capability in the same place. Ask separately who can read a backup, restore it, change its retention or remove it. A successful backup job says little about those permissions.
CISA’s #StopRansomware Guide recommends multifactor authentication, restricted administrative access, network segmentation, protected offline backups and restoration testing. Put those controls against specific weaknesses in your drawing. For example, protect email and remote access with MFA, remove unnecessary exposed services, keep supported software patched and secure backup administration separately. These measures reduce opportunities and potential damage; none makes an existing compromise harmless.
Working machinery can still depend on unavailable information
Our freight company may have working trucks but inaccessible assignments. A warehouse may have functioning equipment yet lack verified inventory or release instructions. Those are operational dependencies on information. They do not require an attacker to control the machinery itself, although direct compromise of connected operational systems is also a concern.
NIST’s Guide to Operational Technology Security addresses both segmentation and the safety and reliability requirements of systems that interact with physical processes. Where your business has operational technology, involve equipment owners and people responsible for safe operations before changing connections or planning isolation. A laptop response procedure is not automatically suitable for a loading system.
For our hypothetical warehouse, the useful question is specific: if the office network were isolated, which information would the loading team lose, and could work continue safely? Have the operations manager answer alongside IT. The dependency may be a login service or instruction file that neither team included in its first sketch.
Walk through one account and one business promise
Choose a normal dispatch account and one scheduled shipment for a review this week. With the system owner, document:
What that account can open, change and administer, including cloud applications and remote-support tools.
Which additional systems the workstation can reach, and which connections the job actually needs.
Whether a separate recovery copy and its management account would remain protected if the workstation were compromised.
Who could contain the affected access, what work would pause and which approved fallback would keep the shipment information trustworthy.
Verify access with your provider using an agreed, non-disruptive check. Record the results and assign an owner to each unnecessary permission or connection. This gives the business a concrete improvement to make, and a clear way to confirm that the improvement worked.
Next in the series: The Warning Signs Before Ransomware Strikes
Comments