Hacker News Reader

There seems to be a lot of confusion about versions without killswitches. This guy says he made a mistake: https://twitter.com/craiu/status/863718940870139904

Interesting for context:

New domains are just trivial modifications of the old one. Still hardcoded. That's unlikely to be a new version, but rather people playing around.

To be more specific, all samples without killswitch were samples of just the ransomware, not the worm spreading it.