> This malware was written bespoke for attacking a specific victim infrastructure, Nothing in the post indicates that it was specific to a single victim. The

> This malware was written bespoke for attacking a specific victim infrastructure, Nothing in the post indicates that it was specific to a single victim. The JNZ update was something everyone used to do to get rid of nag screens in shareware. I'd be very surprised if there wasn't a generic utility for extracting the locations of the right bits at this point, but either way it's a simple process for finding them. Going after the print files just indicates familiarity with SWIFT and PCL. It doesn't actually look like a particularly clever attack to me, at least not from what's in this article. Very basic security mitigations would have prevented it. (Like validating oracle files)