A closer look at NotPetya actions after it infected one endpointThere's been a lot of talk about how NotPetya made it onto corporate networks in late June. There were two main vectors: attachments in phishing emails and an infected update from tax software made by a Ukrainian company. But how did the ransomware spread after it infected just one endpoint? It had two options: the "flat network" exploit and the "stolen NSA tech" path. The former seems to have been the one most frequently used.