@DM_Ronin would be interesting to see what @GrapheneOS has to say on this, given their OS is more secure than stock, yet google hasn't white listed GOS.
@da_667 @GossiTheDog @jhaar
I dealt with a number of ransomware attacks when I was in MSP land, unless it was an idiot who was attacking, usually the security had been disabled before they did any real damage, all we could do was rollback from backup (if they had them).
S1 was usually deployed post exploit via the cyber insurance.
I wouldn't be suprised if it piggybacking the VSS service, Acronis does that and when the SQL VSS breaks all hell breaks loose.