“Ghost” account credentials facilitate ransomware attacks