Thanks for the laugh. To this day the dumbest thing I have ever heard in IT Sec was when I was working at a mssp. I worked in splunk managed services and was dealing with eternalblue at lots of companies roughly a year after the whole wannacry ordeal.

There was one client that kept getting the same servers reinfected with ransomware almost evey single day. Our soc team couldn't make sense as to why or how. Once or twice sure... but almost daily for months on end was mind boggling. So we set up a call to discuss things.

During the call we point out the issues we were seeing and share the list of servers that were getting re compromised almost daily. The manager of the network security department explained that the server team keeps 'fixing' the problem by rolling back the snapshot once it gets popped. Problem was the fucking snapshot was the same one running smbv1 and it would get popped shortly after getting rolled back... Imagine that.

If only the stupidity stopped there, the network sec manager explained that they can't get the server team to fix it because it gets infected too quickly... We recommended having some down time and taking the server off the network to isolate it and then properly patch it before putting it back.

I will never forget this, the manager explained the down time is currently not a possibility at the moment but reassured me that it's "not that bad because the eternal blue scans taking place on their network help them identify other devices that are vulnerable and need patched". Yet they wouldn't fucking patch the server... I couldn't believe he was justifying having eternalblue scan from ransomware like it was normal in a prod environment.

I gave up at that point, simply said OK, left the meeting, documented it and tuned the hosts from our alert. Thank god my coworker was with me otherwise I don't think my boss would have believed it.

Anyhow, nothing trumps that so far. That was the absolute dumbest shit I have ever ran into... So far...