What continues to amaze me is the continued lack of real-time detection "enterprise" products have on even n-day discoveries like this. Even five days passed disclosure, we still have very limited IOC signaling:

1. 212.bat.exe; 1/61; https://www.virustotal.com/gui/file/2c76036ec0869f6b41bd8f7c...

2. haha.msi; 2/61; https://www.virustotal.com/gui/file/1b2d956e3eded3e7220e3ff6...

3. MLANG.dll; 15/61; https://www.virustotal.com/gui/file/a8e7f45d67b50948929adf35...

or if you focus on network/ips/perimeter detections:

4. web.winserve[.]ru; 1/94; https://www.virustotal.com/gui/domain/web.winserve.ru

5. scare[.]su; 3/94; https://www.virustotal.com/gui/domain/scare.su