True stories from the darknet

[MUSIC PLAYING] Imagine being at work in the office and, all of a sudden, the server you're working on goes down. The phones stop working. The screens go blank. And as you investigate, you realize the company has been hacked. The virus is so bad and it's spreading so fast that you frantically start unplugging ethernet cables in an attempt to stop the attack. And you're forced to sever your connection to the internet altogether. [STATIC HISSING] There are so many stories right now about businesses and government departments that are getting hit with ransomware, and it costs them hundreds of thousands of dollars to fix. Russian railways got hit. Banks, hospitals, governments, towns, and the mobile phone operators got hit. Universities in China were hit. FedEx got hit in the US. Telefonica in Spain and Renault in France, they were all infected and their data was held ransom. [STATIC HISSING] Active Directory is the mechanism that Windows computers authenticate to each other, and hackers love attacking this because it has so much data. It has information on all of users and all of the passwords, and it has tons of stuff that a hacker can use to escalate their privileges or move on to other systems. It's a great place to start looking. [STATIC HISSING] Since they had full control of their Active Directory server, they could look anyone up, internally, using their global address list. So I used these stolen credentials. And at that point, I logged into a [? sys ?] [? vault ?] on the domain controller, pulled up all of Active Directory. In just a short time, in a matter of hours, a massive amount of networks and computers were permanently down. Companies all over were scrambling to figure out what happened. How do we fix this? Is there a way to recover or undo this? How do we get stuff working again? [MUSIC PLAYING]