A business called me up recently after having their server hit with ransomware and asked me to help get them back up and running. Part of what they'd love to know (just like everyone in their position) is how it happened. I initially figured that it likely came in through a workstation and spread to mapped network drives on the server. I checked all the workstations on the network, expecting to find one of them infected - nope, they're all fine. After looking at the server some more it was apparent that the server was infected directly. Its a tiny office and it seems pretty certain the infection came in from the internet
Nobody uses the server as a workstation - its in a locked closet. I'm probably way off on some of these thoughts but here's the things I could guess at:
Hamachi VPN was recently installed on the server - could someone...