Re:WannaCry – The largest ransom-ware infection in history
by cpncrunch on Sunday May 14, 2017 @03:04PM
(#14337025)
From what I gather, it tends to be one person in an organisation opening a dodgy attachment, then it spreads through the internal network via unpatched SMB flaw.
Re:WannaCry – The largest ransom-ware infection in history
by Scoundreller on Sunday May 14, 2017 @04:13PM
(#14337343)
That, or they bring a work computer home, get infected, then bring it back to work. Could happen if the network they got infected on resolved all domains (so it didn't execute then), but their corporate network didn't.
This malware somehow got seeded, either by (1) direct scanning the internet for vulnerable systems, or (2) traditional "open-this-link / install-this-file" emails/downloads. Maybe that's why we see at least 3 bitcoin addresses: 3 different "seeding" groups.
Corp networks shouldn't be accepting outside SMB connections, and home routers will block them too, so that's where user-initiated emails/downloads come in (or someone connecting an outside laptop).