A European biomolecular research institute lost a week s worth of research data after a Ryuk ransomware attack traced back to a student trying to save money by buying unlicensed software. The student opted for free software packed with a keylogger that grabbed credentials later used by Totoro to get into a biomolesolecular institute. The lack of required 2FA should raise red flags right there, never mind the fact that Citrix is one of the most widely used platforms that threat actors are actively looking to exploit.
Source: https://threatpost.com/ryuk-ransomware-attack-student/165918/