my tweets are severely limited by my lack of understanding of what I am doing.
Unlike WannaCry this attack DOES NOT SCAN THE INTERNET, it spreads on the local subnet and after completion it REBOOTS & ENCRYPTS drive.
-
It is believed to have originally spread through spear-phishing links and also it uses network shares. It was likely targeted malware first.
I've seen no evidence of spear phishing links, nor network share usage (outside of PsExec).
