Command and control gives malware an operator
The difference between a nuisance and an incident is usually whether somebody is steering.
Automated malware does what it was written to do. Malware with a live channel back has a person adapting to what they find, escalating, and choosing targets. Cutting the channel does not remove the foothold and it removes the adversary's ability to respond to you.
More on Ransomware and malware
- Ransomware is often the last stage, not the firstThe bang is the end of the fuse
- Backups are ransomware targetsThe lifeboat goes first
- Lateral movement turns one foothold into manyAlong the loft, house to house
- Persistence is about surviving changeStill there after the tide
- Living off the land reduces new-tool visibilityThey use your tools, not theirs
- Ransomware recovery is an identity problem tooThe data is the easy half