Ransomware Propagation Paths Through Unmanaged Endpoints

Ransomware operators now treat unmanaged endpoints as a deliberate routing choice, not a gap they happen to stumble into. As more organizations put E/XDR on their primary workstations, attackers adapt by steering their lateral movement toward the devices nobody is watching.

Why ransomware operators deliberately route attacks through unmanaged endpoints

A SANS livestream synthesized findings from the CrowdStrike Global Threat Report and documented a three-hour attack window in which the threat actors touched only one managed endpoint. Every other move in that window ran through systems with no agent on them. It's a routing decision, made in real time, to avoid the one system that could see them.

The same session described something more striking: attackers compromising hypervisors and spinning up new compute instances inside them, then operating from inside those instances entirely outside E/XDR telemetry. The unmanaged device, in these cases, wasn't found. It was built. An attacker with hypervisor access can manufacture a blind spot on demand, run the next phase of the operation from inside it, and leave no sensor anywhere near it.

The structural lesson here matters more than any single incident. A device without an agent is an active resource an adversary can claim, occupy, and operate from, for as long as it takes to finish the job. Every mechanism described in the sections that follow, SMB relay, self-propagating encryptors, IoT pivoting, depends on that resource being available. Understanding that attackers go looking for it, rather than merely benefiting from its existence, changes what the right defensive posture looks like.

SMB protocol and credential reuse turning one compromised device into a network-wide event

The dominant lateral movement path in modern ransomware operations runs through a built-in file-sharing protocol, one that lets Windows machines read and write to network shares. Execution-based endpoint detection, the kind that watches for suspicious processes launching, has nothing to catch, because nothing launched.

Where those credentials come from matters as much as how they get used. The Mandiant M-Trends 2026 Report, cited in the same SANS analysis, found that prior compromise doubled as an initial infection vector, now accounting for double its prior-year share. The credential an attacker uses on a Tuesday may have been stolen weeks or months earlier by someone else.

Stolen credentials are the fuel that makes SMB propagation work. The SANS session noted that credential-based initial access is likely underreported because a remote service connection using known credentials appears in logs looking like normal activity, with none of the failed-login spikes or brute-force patterns that usually tip off a defender. The breach is invisible at the point where most organizations expect to see it.

Unmanaged endpoints feed this cycle directly. A device with no agent coverage is also less likely to have modern credential protections enforced on it, which makes it a reliable source of credentials an attacker can harvest and then use to reach managed systems elsewhere on the network. One weak device becomes the key to every file share it can authenticate against.

Self-propagating encryptors like The Gentlemen and the removal of the human operator from lateral movement

SMB relay still requires a person on the other end making decisions, picking the next target, entering the next set of credentials by hand. Self-propagating ransomware removes that person from the loop entirely, and the result moves at a speed no human-approved containment process can match.

Microsoft's analysis of The Gentlemen ransomware describes a Go-based encryptor deployed by affiliates of the threat actor Storm-2697. The Gentlemen spreads itself using WMI, PsExec, scheduled tasks, Windows services, and PowerShell remoting, all running at the same time, with SMB used to stage the payload for delivery. No operator sits at a keyboard moving from host to host. The malware does that work on its own, across as many machines as it can reach simultaneously.

And each file gets encrypted with its own ephemeral key, which makes bulk decryption after the fact a near-impossible undertaking even if a ransom is paid.

The tempo is what breaks traditional defenses. Concurrent SMB, WMI, and PsExec propagation lets the malware fan out across multiple subnets within seconds. Most containment workflows, the kind where a human reviews an alert and approves an isolation action, were built for adversaries who move at the speed of a person typing commands. A self-propagating encryptor reaches the next subnet before anyone opens a ticket.

The design of The Gentlemen assumes it will land on a system without agent coverage first. Its hidden-share mechanism is built for environments where credential availability is inconsistent, which is precisely the condition an unmanaged device creates. That first unmonitored machine is the entry point the whole architecture is designed around, and it's rarely a server. More often, it's something smaller and easier to overlook.

IoT and OT devices as the on-ramp for network-wide ransomware campaigns

Any device connected to the network without agent coverage is a usable launch point, and small business networks are full of them. The category is far bigger than the laptop IT forgot to enroll.

The CrowdStrike Global Threat Report, cited in the same SANS 2026 analysis, described attackers who got blocked by EDR on managed hosts and responded by finding an unpatched webcam on the corporate network. The device had no agent, no patch cadence, and no one monitoring it, but it had the one thing the attackers needed: a live connection to the rest of the network.

That webcam case is the clearest possible illustration of what an unmanaged device actually is: any system on the corporate network segment that can't run a security agent becomes a staging point for the exact SMB relay and self-propagation techniques already described. IoT devices often can't run an agent in the first place, because they run proprietary firmware built by the manufacturer, with no mechanism for installing third-party software and no vendor patch cycle feeding into them regularly. They stay unmanaged because of how they're built, not because someone forgot to configure them.

For a small or mid-sized business, the office is full of these devices without anyone thinking of them as a security concern: networked printers, IP cameras, smart TVs in conference rooms, building access card readers, HVAC controllers. The propagation path follows a simple sequence: an attacker finds an unpatched firmware vulnerability in one of these devices, uses it as a stable and unwatched foothold, and from there begins SMB propagation or credential harvesting from a source no EDR tool is watching.

SMB exposure to ransomware propagation

Small businesses face the exact same propagation techniques as large enterprises, but without the asset visibility or enforcement infrastructure that would let those techniques get caught before they turn catastrophic.

Everything in a security program depends on knowing what devices exist on the network. Lateral movement can't be detected from a source that was never inside anyone's monitoring scope to begin with. Most small businesses have no continuous process for tracking what's connected to their network. The entire chain of defense is missing its first link before anything else is even attempted.

Endpoint management tools that only track devices, without enforcing security controls on top of that tracking, leave an organization blind to which of those devices are actually dangerous. Knowing that a laptop exists is not the same as knowing whether its patches are current or its disk is encrypted. That separation between management and enforcement is a gap attackers are well positioned to exploit, and it's one most small businesses carry without realizing it.

Identity checks alone don't close that gap either. Without a unified system tying device posture to access decisions, Zero Trust and conditional access policies collapse down to identity-only decisions, made with no reliable information about the device behind the login.

Flat networks make the damage worse once an attacker is inside. Small businesses rarely build out network segmentation the way larger enterprises do, so once an attacker has a foothold, whether through an IoT device, an unmanaged laptop, or a reused credential, SMB has unobstructed reach to every file server and workstation sharing that same network segment. And the window to catch any of this keeps shrinking: the fastest attacks now reach exfiltration within hours or a handful of days, even though dwell time across all incidents hasn't collapsed evenly, with some major 2026 reports showing it climbing past two weeks in other cases. A small business with no continuous monitoring has no realistic chance of spotting and containing propagation before the damage is already done.

Where detection must sit given these propagation paths

SMB-based ransomware frequently never executes a binary on the target device. It reaches a file share remotely using valid credentials and encrypts files as a plain file system operation, so an EDR sensor sitting on that target device may register nothing unusual whatsoever. The attack was designed to happen in a place no execution-based tool is built to watch.

Catching it requires looking at different signals entirely: simultaneous SMB sessions opening to multiple hosts from a single source within a short window, PsExec service installation events, WMI process creation happening on remote machines. Every one of these is visible at the network or identity layer even when the source device carries no agent. The detection doesn't have to happen on the compromised machine. It has to happen on the systems watching the traffic and the logins.

That kind of visibility only works when device management and security enforcement sit on the same platform. Endpoint telemetry is becoming the most important data source security teams have, but only when the system tracking device posture and the system enforcing policy are the same system. A management layer that watches devices separately from a security layer that enforces rules against them creates exactly the gap between seeing a problem and acting on it.

Speed is the other requirement. As The Gentlemen case shows, any containment step that waits on a human to approve network isolation gives a self-propagating encryptor more time to reach the next subnet. The containment architecture has to be able to isolate a device automatically, without a ticket sitting in a queue first. By the time a person reviews an alert, the encryptor has often already moved past the point where that review would have mattered.

All of this still comes back to the same starting requirement. Detection at any layer, network, identity, or file system, depends on knowing a device exists. An unmanaged endpoint missing from the asset inventory can't be monitored, segmented, or contained, no matter how advanced the tooling is on every other device in the building.

Practical steps an SMB without a security team can take to reduce propagation risk today

Closing these propagation paths doesn't take a dedicated security team. It takes a short list of controls, enforced consistently, each aimed directly at a mechanism this piece has already described.

Start with a complete device inventory. Nothing else on this list works without it: every IoT device, shared workstation, personal device on the corporate Wi-Fi, and anything else that touches a file share needs to be accounted for before it can be protected.

Enroll every device that can be enrolled in a unified endpoint management system. A device with a known, managed security posture, patch level, encryption status, compliance standing, can be monitored and pulled off the network the moment it falls out of line. A device nobody is tracking can't be any of those things.

Turn on multi-factor authentication for every account that can reach file shares or remote services. MFA won't stop a credential from being stolen, but it raises the cost of using that stolen credential high enough that many opportunistic attackers give up and move elsewhere.

Segment the network so IoT and OT devices can't reach file servers or workstations directly. Basic VLAN separation between device categories keeps a compromised printer or camera contained to its own corner of the network instead of giving it a straight line to the file server.

Turn on file access pattern monitoring at the file server level. Watching for mass-rename operations or rapid sequential writes, the signature of encryption in progress, catches SMB-based ransomware acting remotely even when the source device is unmanaged and invisible to every other tool in the stack.

Test backup restores regularly. An isolated, immutable backup limits how much leverage a ransom demand actually has, but only if it can be restored when it matters. A backup nobody has tested is a hope, not a plan.

The throughline across every one of these steps is the same: organizations that keep device management and security enforcement as two separate systems are carrying a gap that attackers already know how to use. Unified endpoint management, visibility, control, and enforcement running on the same platform, is the foundation everything else on this list depends on. A single platform covering device management, identity enforcement, and compliance monitoring closes that visibility gap, so a small business doesn't have to juggle several vendor relationships at once, and that coordination overhead is what falls apart under the compressed timelines these attacks now run on.

Ransomware operators go looking for the blind spot deliberately. Closing it is what turns an attack from catastrophic into survivable.