Entry and propagation
The initial entry vector was not officially determined; after compromise it propagated through network shares.
Targets
Business networks and workstations, with a documented link to the Saudi Aramco incident.
Impact
Unrecoverable data after wiping and disruption across a large part of a business network.
Defense
Separate user zones, restrict shares and administrative accounts, and detect abnormal disk-write behavior.