How does ransomware get into major networks, such as schools or other large public agencies?

It doesn't matter how strong your defenses are and how skilled your IT team is, when fucking Linda in accounting opens EVERY SINGLE GODDAMN ATTACHMENT SHE GETS!!!

Attackers have to be right once. Defenders have to be right every time.

Also, user.

People are by far the biggest security risk. I have seen personally tailored phising scams that were even able to fool experienced secops staff.

Wouldn't anyone working for such an agency be educated enough about these threats not to do so?

Ahahhahhahha. Ahem. Hahahahahaha. Give me a moment to compose myself.

Thank you for that moment.

Anyway, the assumption is very reasonable. And, oh how I wish it were so.

But the answer is no, they're human, and even high tech organizations need specialists in other subjects (law, finance, book-keeping, etc) who aren't at all technology savy.

To be clear, education is such subjects is often mandatory. It just doesn't always take. Largely because many staff watch the educational video, and think they understood it, but don't really have any context for it. For example, they might learn it and still think, "Well, it clealy doesn't apply to an email from our CEO. He wouldn't send something nasty!"

Edit: The solution I've seen is a lot of education. It's not enough to say "don't click suspicious links", there's got to be ongoing training on the definition of "suspicious".

Wouldn’t someone still have to deliberately click a malicious link to install it? Wouldn’t anyone working for such an agency be educated enough about these threats not to do so?

lol, lmao even. I worked IT for a hospital network for about 4 years. Doctors aren't any smarter than anyone else when it comes to using a computer, because it's not what they spent all their years studying. People click on dumb shit they shouldn't all the time, doesn't matter how "smart" they're supposed to be.

I once did a Phishing test for a customer during an internship. We had 50% of all employees click the Phishing link, and 30% of all employees input their login info.

What was the form? A new data protection agreement (which was the current one copied from the firm's site) which required a login to accept.

These employees all got regular cybersecurity training, and yet they still fell for such an obvious fake login

one of the primary tenets of IT is that end users do not read. they click things like crazy, even shit they shouldnt.

the bigger the company the worse this is because volume.

its almost always an attachment bomb, or a link to malicious packages on teh web.

I work in a public school. The older teachers are the ones that don't even look at the sender address. "Oh, this email that sort of looks like its from an employee says to blindly open this file that I would realize is clearly fake if I took more than two seconds to look at it? I'm on it!"

Our union negotiator didn't understand different sheets in Excel files. Had a document he wanted to share out on sheet one. For some reason on sheet two he had every union employee's name, birth date, social security number, address, etc. in plain text. Emailed to the entire school district. I caught it immediately and made them aware. The frantic emails to my friend the IT guy were hilarious. "I NEED YOU TO GO INTO EVERYONE'S EMAIL AND DELETE THE MESSAGE I JUST SENT." Then when it was explained that you can't just take it back, another frantic district email "DO NOT OPEN MY PREVIOUS EMAIL. JUST DELETE." Again, not understanding that unless they empty their trash, its still recoverable for 30 days.

A classic is to just drop of 2 or 3 infected USB sticks, maybe with bait labels, on the parking lot before the first employees arrive. repeat a few times and just wait until someone plugs it in to investigate.

another good trick is to infiltrate the cleaners.

Through the holy trinity of gaping holes: Windows, Office, and Exchange. And add lazy or stupid sysadmins on top who don't care to update their stuff, they make break-ins even easier.

An advanced phishing attack can be incredibly hard to detect. Here's an example of a browser vulnerability that allowed malicious sites to spoof legitimate looking domains. It's been fixed since then, but it's a constant battle between fixing exploits and new ones being found. A sophisticated operator can come up with ways to trick even the most tech savvy user, and most users will fall for more obvious tricks than that.

I remember reading an article by a penetration tester years ago at this point. His company is hired by all sorts of companies to test their network security etc. He described one client that thought it had the best network security money could buy. The pen tester took a novel approach (at that time) and put a benign Trojan on a bunch of random usb sticks then scattered them around the employee parking lot, outdoor smoking areas, etc. sure enough some of them started “phoning home” from inside the clients network fairly quickly.

My own employer has been the target of phishing and other attacks over the years. Our security team now contracts with a company that randomly sends out well crafted phishing emails to employees to see if they can detect it or if they click on a questionable link in the message. If an employee clicks on one of these then they are immediately told that they failed a test and are automatically signed up for a training session on spotting phishing and other scams.

Spearfishing is probably the lowest risk and easiest way to get access to a specific network. The attacker can get a bunch of info about an organization (technologies used, people employed, physical locations) through LinkedIn or whatever social media website, and then target a specific person.

Once a target is identified, the next step would be getting that person to follow a link to type in a password, or getting them to install malware, or do whatever it is the attacker wants them to do. I read an article about a dude that got fairly big companies to pay him money by just sending fake bills.

Because some fucker working there clicked on some email he shouldn't have.

The MGM attack originated with calling their help desk pretending to be somebody inside. They found enough info on LinkedIn to be convincing enough to get credentials https://www.vox.com/technology/2023/9/15/23875113/mgm-hack-casino-vishing-cybersecurity-ransomware

People.

Since people are covering the more common options, I'll point out a rarer one. If I remember right, (please correct me if I'm wrong) the Stuxnet virus was able to infiltrate a highly sensitive nuclear enrichment facility because someone planted a zip drive in the parking lot, and some employee went ahead and plugged it in at work to see what it was.

Can totally tell you, that most people do not care. They do get training and notifications but they don't try to learn. The only people that actually care about it are some techies and the CFO.

Smart people can still do dumb things. Some are also highly skilled in some areas but terrible in others. My uncle was a heart surgeon, but he was terrible at driving.

It's a different kind of scam from the ones you see on kitboga. Those are generally confidence scams meant to leverage tech illiteracy. Ransomware attacks are more like stepping on a landmine. They are these nasty payloads that are just out there on the internet, usually with some kind of passive social engineering like a website that mimics a familiar site and/or phishing emails to get that payload into the network.

There are many ways in. Sometimes no one has to click on or do anything, instead the attacker finds a security vulnerability in e.g. a web application, which gives them access to the server the app is running on. From there the attacker can look for other vulnerabilities to penetrate further into the network. Or if the system/network admin hasn't properly configured/secured the network, then the attacker can easily move into other parts of the network.

Edit: After reading some of the responses, it's made me realize why IT often wants to heavily restrict what you can do on a work PC, which is frustrating from an end user perspective, but if people are just clicking links in emails and not following basic internet safety, then damn.

I... I.. 🥲 thank you.