US-CERT reports destructive malware activity against a major entertainment company using an SMB worm tool with multiple components for propagation, access, proxying, and wiping. The worm brute-forces Windows SMB shares on port 445, copies itself to reachable hosts, sends spread logs to command-and-control infrastructure, and accepts new scanning tasks. Installed components include a listening implant on TCP 195 or 444, a service-DLL backdoor with file transfer and command execution, a proxy tool often listening on TCP 443, and destructive tools that overwrite the MBR or delete files. The wiper can move laterally through Windows shares using configured hostnames, usernames, and passwords, copy taskhostXX.exe, timestomp it to match calc.exe, launch it remotely with wmic.exe, then remove the temporary share. The operational risk is high because successful execution can make systems inoperable and destroy data beyond practical recovery.