How Ransomware Operates & Prime Infection Vectors in Small Teams

1. Disconnect Network: Cut internet access immediately to halt command-and-control communication.
2. Invalidate Credentials: Reset the compromised password from a secondary clean host.
3. Blameless Reporting: Foster a culture where employees report accidental clicks instantly.

How attackers exploit exposed Remote Desktop (RDP) ports and outdated software to encrypt business assets.

1. Ransomware Threat Vectors:

Ransomware executes high-speed cryptographic encryption across local drives and network shares, leaving ransom notes demanding cryptocurrency payments.

Ransomware attack screen — Figure 3.1: Critical system lockout resulting from uncontained ransomware infection.

2. Closing Open RDP Port 3389:

Exposing Remote Desktop Protocol directly to the internet is an open invitation for automated dictionary brute forcing. Enforce VPN tunnels.

Module 2 Knowledge Check: Authentication & CredentialsPrevious

The Immutable 3-2-1 Backup Strategy: Your True Ransomware ShieldNext