[Kali909]

There's the bitcoin ransom aspect, but presumably a worm like this could extract a massive amount of data from infected servers and send that back to someone/somewhere?

Bank transactions, patient medical data, stored passwords/keys/CA info, contacts, emails, configuration files, registry dumps for firewall rules etc etc. (I'm not that creative so there's probably a lot more that's been exfiltrated).

Pretty hellish knowing they'd let that quietly sit there, in the name of espionage. I'm not sure the benefits outweigh the damage they're doing, without even mentioning the chilling effect and lack of confidence this instills in IT everywhere.

[wu-ikkyu]

Right, the real money is not going to come from the bitcoin ransoms, but from the information on millions of patients which they surely made copies of.