Re: Linux machine hit by ransomware
On Tue, 8 Jul 2025 07:02:09 +0200
<tomas@tuxteam.de> wrote:
> On Mon, Jul 07, 2025 at 09:44:11PM +0200, Detlef Vollmann wrote:
>
> [...]
>
> > The main point is to find out which system was hit.
> > According to the description it looks like the Linux server itself
> > wasn't hit, but a different system that can access files on the
> > server via network...
>
> Yes. The guess put forward elsewhere in this thread that it was
> perhaps a Windows client over Samba is pretty compelling. Especially
> the observation that only world-writable files were hit is a finger
> pointing in this direction.
>
Presumably if there was 8-year-old Linux ransomware, we would know about
it already. I think it is fairly certain it was a Windows machine that
was compromised.
--
Joe
Reply to: