Hackers spoof IT support's number, spin up Windows 7 VM to launch ransomware attack
MFA "did not protect against the continued use of WMIC and remote PowerShell activity"
MFA "did not protect against the continued use of WMIC and remote PowerShell activity"