Most importantly, because the ransomware is executing with the compromised user’s privileges, any file the legitimate, now-compromised user has access to, including network shares and backups, is fair game for the ransomware.