Attack path
A compromised M.E.Doc update was followed by internal spread through SMB, credentials and administrative tools.
Confirmed impact
Broad disruption and irrecoverable encryption affected transport, pharmaceuticals, government and other sectors, with losses in the billions.
Response
Isolation, clean network rebuilding and international investigations that formally attributed the operation.