Malicious activity leads to root path