my tweets are severely limited by my lack of understanding of what I am doing.
Petya - 1) It's using SMB, Psexec and Wmic 2) No kill switch 3) Seen no C2 traffic, not sure how that bit works.
-
Petya - you need to apply SMB patches ASAP. If every user in your org has local admin on every laptop, you may want to reconsider that.
Petya - reason for every user not being local admin = you are a remote admin on other laptops then == spread.
