Attackers and lateral movement
In Chapter 1, Ransomware Attack Vectors and The Threat Landscape, we went through some of the different ransomware variants and how they worked. In most cases, it starts with an endpoint that attackers use to do reconnaissance of the network and infrastructure.
Then, attackers often use a combination of different ways to gain further access to the infrastructure:
- Reusing credentials found on the endpoint to log on to servers using Remote Desktop Protocol (RDP)
- Using tools such as Bloodhound to find attack paths to administrator accounts in Active Directory
- Vulnerabilities such as Zerologon
- Performing Kerberoasting using tools such as Rubeus
- Finding network shares and sensitive content using modules such as Invoke-ShareFinder
Unfortunately, we have also had vulnerabilities such as PrintNightmare, which allowed hackers that had access to an endpoint to easily compromise print servers or servers that ran the Print Spooler...
