Can a ransomware attack succeed with no root privileges, but instead if it does have privileged user access?

Question

If an attacker succeeds in getting the password of an IT support privileged account (that has Domain Control rights), can he successfully carry out the attack and do the lateral movement needed between the Domain Controllers and/or users?

Answer 1

Yes, if an attacker has domain admin rights they can usually encrypt anything on any system that's joined to the domain.

You don't even need administrative rights for most ransomware attacks - normal users have permissions to access lots of files and network shares. However, they're unlikely to be able to encrypt or destroy any backups that exist.

Answer 2

I found more interesting explanation on this site: What Does 'Privileged Account' Really Mean?

What Does 'Privileged Account' Really Mean?

Privileged access has become a hot topic recently. For the first time ever, the Verizon Data Breach Investigations Report actually included privileged access as its own section in the report with some not so surprising results. Below are a couple of interesting takeaways from the report:

> Weak or common passwords were the cause of 63 percent of all breaches
> 53 percent of the breaches were due to the misuse of privileged accounts

Now that we know how important these accounts are, how do we know exactly what makes an account 'privileged'? One easy rule of thumb is to count any account with access to monetizable data (protected health information, credit card numbers, social security numbers, etc.) as a privileged account.

However that’s not all. There are other kinds of privileged accounts. What you have to decide for your organization is what privilege data is, where it is, and who has access to it. Control of privileged accounts is a major factor in compliance across all regulations in every industry. If that definition is a bit too broad, here are the most common types of privileged accounts: ...

Domain Admin Accounts

Domain admins have privileged access across all workstations and servers on a Windows domain. These are the most extensive and robust accounts across your network because they have complete control over all domain controllers and the ability to modify membership of every administrative account within the domain. Compromise of these accounts are often listed as the 'worst case scenario' and should be monitored very closely.