SamSam ransomware is associated with which threat group and exploits unpatched servers present in the target network?

SamSam ransomware is associated with which threat group and exploits unpatched servers present in the target network?

• A. SamSam ransomware
• B. WannaCry
• C. Ryuk
• D. Maze

Answer: (A)

The tactic being tested is how the threat actor operates once inside a target network—specifically, using compromised access to reach unpatched servers and spread encryption. SamSam is known for this approach: the attackers gain initial access (often through stolen credentials or exposed services), then move laterally to identify and exploit unpatched servers within the network and deploy ransomware across them. This pattern ties the SamSam ransomware directly to a threat group that focused on targeted intrusions and network-wide encryption, rather than relying on broad phishing or worm-like spreading. Other ransomware families have different spread methods— WannaCry exploited a widely publicized Windows vulnerability to propagate, Ryuk typically involved targeted intrusions with manual steps, and Maze combined encryption with data exfiltration—but the scenario described—exploiting unpatched servers present in the target network—best fits the SamSam operation.

The tactic being tested is how the threat actor operates once inside a target network—specifically, using compromised access to reach unpatched servers and spread encryption. SamSam is known for this approach: the attackers gain initial access (often through stolen credentials or exposed services), then move laterally to identify and exploit unpatched servers within the network and deploy ransomware across them. This pattern ties the SamSam ransomware directly to a threat group that focused on targeted intrusions and network-wide encryption, rather than relying on broad phishing or worm-like spreading.

Other ransomware families have different spread methods— WannaCry exploited a widely publicized Windows vulnerability to propagate, Ryuk typically involved targeted intrusions with manual steps, and Maze combined encryption with data exfiltration—but the scenario described—exploiting unpatched servers present in the target network—best fits the SamSam operation.