Entry and propagation
A compromised software supply chain followed by internal propagation through SMB, administrative tools and stolen credentials.
Targets
Ukrainian organizations first, then global transport, health, pharmaceutical and commercial firms.
Impact
Irrecoverable encryption and global losses in the billions; three documented victims alone lost nearly one billion dollars.
Defense
Control supplier risk, isolate administration tools, reduce privileges, segment networks and keep offline backups.