@lanodan@cks Ransomware operators tend not to care very much about those, except as a side-effect. But if somebody truly wanted to wreck infrastructure, absolutely those are important.
@cks ooo, a whole department getting ransomed all at once on the same fileserver. Ouch. On the other hand, maybe you'd get to interrupt it mid-flow, or it would interrupt itself.
A few weeks ago, tired of telling people that when we talk about "we need to make systemic change" that doesn't mean "everybody but YOU," I made a bookmark shortcut called "A TOADA SO" that linked to a news story about me, um, "springing into action" in response to an attempted ransomware attack.
Today I decided that's just going to be my bookmark tag for other HEs getting rocked. "This was only not us because we got *lucky* now quit it!"