"Collecting ransom money was never the top priority for the TeleBots group," it said, suggesting Ukraine was the target but the virus spread globally as "affected companies in other countries had VPN connections to their branches, or to business partners, in Ukraine."