The version of the program used to demand ransoms from the operators of frozen computer systems exploits vulnerabilities in older and unlicensed versions of Microsoft Windows, used widely in Russia, that did not have security patches.