<story><title>WannaCry – New Variants Detected</title><url>https://blog.comae.io/wannacry-new-variants-detected-b8908fefea7e</url></story><parent_chain></parent_chain><comment><author>yardstick</author><text>Anyone know someone at the Tor Project? Based on a breakdown I read, it downloads the Tor client from 
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;dist.torproject.org&amp;#x2F;torbrowser&amp;#x2F;6.5.1&amp;#x2F;tor-win32-0.2.9.10.zip&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;dist.torproject.org&amp;#x2F;torbrowser&amp;#x2F;6.5.1&amp;#x2F;tor-win32-0.2.9...&lt;/a&gt;&lt;p&gt;It would be simple to rename this link (or perform a referer check or something else to stop automated downloads), at least temporarily.&lt;p&gt;Yes, the malware authors will release an update with the different URL (or another hosting site entirely, or embedded), but at least it would provide time for vulnerable users to install patches. Especially now that Microsoft has released a patch for XP.&lt;p&gt;(I&amp;#x27;m basing this URL info on the breakdown found at &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.bleepingcomputer.com&amp;#x2F;news&amp;#x2F;security&amp;#x2F;wannacry-wana-decryptor-wanacrypt0r-technical-nose-dive&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.bleepingcomputer.com&amp;#x2F;news&amp;#x2F;security&amp;#x2F;wannacry-wana...&lt;/a&gt;)</text></comment>
<story><title>WannaCry – New Variants Detected</title><url>https://blog.comae.io/wannacry-new-variants-detected-b8908fefea7e</url></story><parent_chain></parent_chain><comment><author>rhubarbcustard</author><text>What&amp;#x27;s special about WannaCry that has made this such a widespread thing? I presume there&amp;#x27;s has been plenty of malware for a while that can propagate itself around a network of unpatched old Windows machines and people have been trying to get users to clicks on emails to infect themselves for years.&lt;p&gt;So why now? What&amp;#x27;s so special now?</text></comment>