[flipper35]

Originally Posted by stealthn

A good hacker/malware goes after the backups as well. As someone that does security as part of my job people would be shocked at how much is going on all day, everyday. Your Internet is constantly being probed, I could go on for days on this, really coordinated groups/Govs do their research on your website, social media, etc. I see company websites that show the type of control systems a company uses and sure enough they are constantly scanned for those control system ports on all their public IP’s.

Of course it’s so much easier just to drop something via a phish email, or just social engineer a company: https://youtu.be/lc7scxvKQOo

The higher end disaster recovery stuff is a little better insulated against being infected but even those can get infected as well because sometimes you are infected for weeks to months and don't know it. By the sounds of it this company did not have state of the art stuff and just paid/had insurance pay the ransom to cut down on recovery time.