The DOI matches its Crossref record; 39 of the 39 references it cites were found in a registry or an index.
Ransomware: Analysing the Impact on Windows Active Directory Domain Services
Open accessAbstract
Ransomware has become an increasingly popular type of malware across the past decade and continues to rise in popularity due to its high profitability. Organisations and enterprises have become prime targets for ransomware as they are more likely to succumb to ransom demands as part of operating expenses to counter the cost incurred from downtime. Despite the prevalence of ransomware as a threat towards organisations, there is very little information outlining how ransomware affects Windows Server environments, and particularly its proprietary domain services such as Active Directory. Hence, we aim to increase the cyber situational awareness of organisations and corporations that utilise these environments. Dynamic analysis was performed using three ransomware variants to uncover how crypto-ransomware affects Windows Server-specific services and processes. Our work outlines the practical investigation undertaken as WannaCry, TeslaCrypt, and Jigsaw were acquired and tested against several domain services. The findings showed that none of the three variants stopped the processes and decidedly left all domain services untouched. However, although the services remained operational, they became uniquely dysfunctional as ransomware encrypted the files pertaining to those services.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Lack of patch management is one of the main causes of inherent IIoT security vulnerabilities.
“Lack of patch management is one of the main causes of inherent IIoT security vulnerabilities [16].”
From A Critical Overview of Industrial Internet of Things Security and Privacy Issues Using a Layer-Based Hacking Scenario (2023) · cites this paper as [16]
The Literature Review (§2.1; page unavailable) says organisations neglect software updates and that patching addresses security vulnerabilities in Windows domain controllers. It does not identify lack of patch management as a main cause of inherent IIoT vulnerabilities; its discussion concerns Windows servers, not IIoT devices. (LLM, conf=0.86)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Barriers to Integrating Quantitative and Qualitative Research
Bryman, A. E. (2007) · Journal of Mixed Methods Research · doi:10.1177/2345678906290531 · Cited by 1,305
Dynamic Malware Analysis in the Modern Era—A State of the Art Survey
Or-Meir, O., Nissim, N., Elovici, Y., & Rokach, L. (2019) · ACM Computing Surveys · doi:10.1145/3329786 · Cited by 389
Convolutional Neural Network for Remote-Sensing Scene Classification: Transfer Learning Analysis
de Lima, R. P., & Marfurt, K. J. (2019) · Remote Sensing · doi:10.3390/rs12010086 · Cited by 294
Ransomware attacks: detection, prevention and cure
Brewer, R. (2016) · Network Security · doi:10.1016/s1353-4858(16)30086-1 · Cited by 216
A retrospective impact analysis of the WannaCry cyberattack on the NHS
Ghafur, S., Kristensen, S. R., Honeyford, K., Martin, G., Darzi, A. W., & Aylin, P. P. (2019) · npj Digital Medicine · doi:10.1038/s41746-019-0161-6 · Cited by 206
Tracking Ransomware End-to-end
Huang, D. Y., Aliapoulios, M., Li, V. G., Invernizzi, L., Bursztein, E., McRoberts, K., Levin, J., Levchenko, K., Snoeren, A. C., & McCoy, D. (2018) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2018.00047 · Cited by 200
Leveraging Machine Learning Techniques for Windows Ransomware Network Traffic Detection
Alhawi, O. M. K., Baldwin, J. S., & Dehghantanha, A. (2018) · Advances in information security · doi:10.1007/978-3-319-73951-9_5 · Cited by 185
On the economic significance of ransomware campaigns: A Bitcoin transactions perspective
Conti, M., Gangwal, A., & Ruj, S. (2018) · Computers & Security · doi:10.1016/j.cose.2018.08.008 · Cited by 150
A Privacy-Preserving Healthcare Framework Using Hyperledger Fabric
Stamatellis, C., Papadopoulos, P., Pitropakis, N., Katsikas, S. K., & Buchanan, W. (2020) · Sensors · doi:10.3390/s20226587 · Cited by 150
Self-citationThe Ransomware-as-a-Service economy within the darknet
Meland, P. H., Bayoumy, Y. F. F., & Sindre, G. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101762 · Cited by 149
O’Kane, P., Sezer, S., & Carlin, D. (2018) · IET Networks · doi:10.1049/iet-net.2017.0207 · Cited by 122
The cyber insurance market in Sweden
Franke, U. (2017) · Computers & Security · doi:10.1016/j.cose.2017.04.010 · Cited by 103
Launching Adversarial Attacks against Network Intrusion Detection Systems for IoT
Papadopoulos, P., von Essen, O. T., Pitropakis, N., Chrysoulas, C., Mylonas, A., & Buchanan, W. J. (2021) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp1020014 · Cited by 83
Self-citationForensic Analysis of Ransomware Families Using Static and Dynamic Analysis
Subedi, K. P., Budhathoki, D. R., & Dasgupta, D. (2018) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2018.00033 · Cited by 81
Practical Defences Against Model Inversion Attacks for Split Neural NetworksPreprint
Titcombe, T., Hall, A. J., Papadopoulos, P., & Romanini, D. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2104.05743 · Cited by 71
Self-citationSM-D (2012) · Network Security · doi:10.1016/s1353-4858(12)70109-5 · Cited by 65
Privacy and Trust Redefined in Federated Machine Learning
Papadopoulos, P., Abramson, W., Hall, A. J., Pitropakis, N., & Buchanan, W. J. (2021) · Machine Learning and Knowledge Extraction · doi:10.3390/make3020017 · Cited by 54
Self-citationThe dynamic analysis of WannaCry ransomware
Kao, D., & Hsiao, S.-C. (2018) · International Conference on Advanced Communication Technology · doi:10.23919/icact.2018.8323682 · Cited by 50
Do Crypto-Currencies Fuel Ransomware?
Kshetri, N., & Voas, J. (2017) · IT Professional · doi:10.1109/mitp.2017.3680961 · Cited by 49
A novel method for recovery from Crypto Ransomware infections
Weckstén, M., Frick, J., Sjöström, A., & Järpe, E. (2016) · IEEE International Conference on Computer and Communications (ICCC) · doi:10.1109/compcomm.2016.7924925 · Cited by 48
On the Economic Impact of Crypto-ransomware Attacks: The State of the Art on Enterprise Systems
Zimba, A., & Chishimba, M. (2019) · European Journal for Security Research · doi:10.1007/s41125-019-00039-8 · Cited by 42
Fujs, D., Mihelič, A., & Vrhovec, S. L. R. (2019) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3339252.3341479 · Cited by 37
The state of ransomware. Trends and mitigation techniques
Adamov, A., & Carlsson, A. (2017) · IEEE East-West Design & Test Symposium (EWDTS) · doi:10.1109/ewdts.2017.8110056 · Cited by 36
A Privacy-Preserving Healthcare Framework Using Hyperledger Fabric
Stamatellis, C., Papadopoulos, P., Pitropakis, N., Katsikas, S. K., & Buchanan, W. J. (2020) · NORA - Norwegian Open Research Archives · Cited by 34
Self-citationCartwright, A., & Cartwright, E. J. (2019) · Games · doi:10.3390/g10020026 · Cited by 33
Zimba, A., Simukonda, L., & Chishimba, M. (2017) · Zambia ICT Journal · doi:10.33260/zictjournal.v1i1.19 · Cited by 24
Privacy-Preserving Passive DNS
Papadopoulos, P., Pitropakis, N., Buchanan, W. J., Lo, O., & Katsikas, S. K. (2020) · Computers · doi:10.3390/computers9030064 · Cited by 23
Self-citationHassan, N. A. (2019) · Apress eBooks · doi:10.1007/978-1-4842-4255-1 · Cited by 21
The dynamic analysis of WannaCry ransomware
Kao, D., & Hsiao, S.-C. (2018) · International Conference on Advanced Communication Technology · doi:10.23919/icact.2018.8323681 · Cited by 18
Privacy Preserving Passive DNS
Papadopoulos, P., Pitropakis, N., Buchanan, W. J., et al. (2020) · NORA - Norwegian Open Research Archives · Cited by 15
Self-citationHassan, N. A. (2019) · Apress eBooks · doi:10.1007/978-1-4842-4255-1_3 · Cited by 13
CRYPTO RANSOMWARE ANALYSIS AND DETECTION USING PROCESS MONITOR
Kardile, A. B. (2017) · UTA ResearchCommons (University of Texas Arlington) · Cited by 11
The Exploitation of Cyber Domain as Part of Warfare: Russo-Ukrainian War
Limnéll, J., & The Society of Digital Information and Wireless Communication (2015) · International Journal of Cyber-Security and Digital Forensics · doi:10.17781/p001973 · Cited by 10
An Analysis of the Impact of WannaCry Cyberattack on Cybersecurity Stock Returns
Castillo, D., & Falzon, J. M. (2018) · RePEc: Research Papers in Economics · Cited by 10
Infection, Self-reproduction and Overinfection in Ransomware: The Case of TeslaCrypt
Lemmou, Y., & Souidi, E. M. (2018) · International Conference on Cyber Security and Protection of Digital Services (Cyber Security) · doi:10.1109/cybersecpods.2018.8560670 · Cited by 10
Economic Analysis of RansomwarePreprint
Hernandez-Castro, J. C., Cartwright, E. J., & Stepanova, A. (2017) · SSRN Electronic Journal · doi:10.2139/ssrn.2937641 · Cited by 10
Decentralised Privacy: A Distributed Ledger Approach
Papadopoulos, P., Pitropakis, N., & Buchanan, W. J. (2021) · Springer eBooks · doi:10.1007/978-3-030-58675-1_58-1 · Cited by 4
Self-citationInternet Information Services (IIS) 7.0 Administrator's Pocket Consultant
Stanek, W. R. (2007) · Cited by 3
Evaluating Tooling and Methodology when Analysing Bitcoin Mixing Services After Forensic Seizure
Young, E. H., Chrysoulas, C., Pitropakis, N., et al. (2021) · International Conference on Data Analytics for Business and Industry (ICDABI) · doi:10.1109/icdabi53623.2021.9655843 · Cited by 3
Self-citation
Flagged first, then by citations
Research works printed but not linked: 4
- Lexico (2021, December 22). Domain|Definition of Domain by Oxford Dictionary on Lexico.com. Available online: https://www.lexico.com/definition/domain.
- Lexico (2021, December 22). Malware|Definition of Malware by Oxford Dictionary on Lexico.com. Available online: https://www.lexico.com/definition/malware.
- Bistarelli, S., Parroccini, M., and Santini, F. (2018, January 6–9). Visualizing Bitcoin Flows of Ransomware: WannaCry One Week Later. Proceedings of the Italian Conference on Cybersecurity (ITASEC), Milan, Italy.
- Byrne, D., and Thorpe, C. (2017, January 29–30). Jigsaw: An investigation and countermeasure for ransomware attacks. Proceedings of the European Conference on Cyber Warfare and Security, Dublin, Ireland.
Cited by
Sorted by citations
Eyeleko, A. H., & Feng, T. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3308195 · Cited by 38
“This was perfectly illustrated by the WannaCry ransomware attack [16], where despite the fact that Microsoft published a patch to fix the vulnerability, several companies in the machine and industrial networking industries did not successfully install it.”
Proactive ransomware prevention in pervasive IoMT via hybrid machine learning
Tariq, U., & Tariq, B. (2024) · Indonesian Journal of Electrical Engineering and Computer Science · doi:10.11591/ijeecs.v34.i2.pp970-982 · Cited by 3
Metadata
- Authors
- McDonald, G., Papadopoulos, P., Pitropakis, N., Ahmad, J., & Buchanan, W. J.
- Affiliations
- Edinburgh Napier University (GB)
- Corresponding author
- Papadopoulos, Pavlos
- Pitropakis, Nikolaos
- Venue
- Sensors
- Publisher
- MDPI AG
- Published
- 2022-01-26
- Volume
- 22
- Issue
- 3
- Pages
- 953
- ISSN
- 1424-8220 (ISSN-L)
- PMC
- PMC8838225
- OpenAlex
- W4210464256
- Cited by
- 32
- References
- 39
- Citations by year
- 2026: 1 · 2025: 9 · 2024: 8 · 2023: 11 · 2022: 3
- FWCI
- 3.57
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Sensors (publishedVersion, cc-by)
- PubMed Central (publishedVersion, cc-by)
- PubMed (publishedVersion)
- Edinburgh Napier Research Repository (Edinburgh Napier University) (publishedVersion, cc-by)
- arXiv (Cornell University) (submittedVersion)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Research Output (Edinburgh Napier University) (submittedVersion, other-oa)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Software › Advanced Malware Detection Techniques
- Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
- Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
- Keywords
- ransomware, crypto-ransomware, Windows Server, WannaCry, Jigsaw, dynamic analysis, file encryption, cyber situational awareness, enterprise security
- MeSH terms
- Computer Security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
