3 ms·

Especially since the user is the one being tricked into executing the ransomware.

• mikewarot 6y ago
  Why does the user have access to the backups?
  • chefkoch 6y ago
    If you are an enterprise, they will try to get admin credentials so they can crypt everything, even domain controllers.
  • kemotep 6y ago
    I was speaking in the context of the files, not the backups. How is this program to know that a file edited by the virus to encrypt is legitimate or not when the edit is being made by a user that created and owns those files? The backups themselves can be contaminated months before the encryption and ransomware attack is sprung. Restoring from last week or last month's backup might still lead to your system being encrypted. Additionally, as the other user pointed out the goal would be to gain access to the appropriate user with the level of permissions, such as an admin or root account, and use those credentials to carry out the attack.