Anatomy of Ryuk Attack: 29 Hours From Initial Email to Full Compromise

To compromise additional systems on the network, the attackers used various methods, including remote WMI, remote service execution with PowerShell, and a Cobalt Strike beacon dropped over SMB.