Info screens, ATMs etc. are easily reimaged though - no data loss. Anyway: http://baesystemsai.blogspot.se/2017/05/wanacrypt0r-ransomworm.html http://baesystem

Info screens, ATMs etc. are easily reimaged though - no data loss. Anyway: http://baesystemsai.blogspot.se/2017/05/wanacrypt0r-ransomworm.html http://baesystemsai.blogspot.se/2017/05/wanacrypt0r-ransomwo... The initial infection vector is still unknown. Reports by some of phishing emails have been dismissed by other researchers as relevant only to a different (unrelated) ransomware campaign, called Jaff. There is also a working theory that initial compromise may have come from SMB shares exposed to the public internet. Results from Shodan show over 1.5 million devices with port 445 open – the attacker could have infected those shares directly. Surprisingly large amount of SMB shares exposed directly to internet, that would of course be a great starting point.