  In the final step, the other subsidiary active directory servers and all the endpoint machines will download the scheduled task and execute the ransomware.         Figure.1 The attacker uses an Active Directory (AD) scheduled task to deploy the ransomware in the customer environment.