heres some more info on it.
While the Witty worm is only the latest in a string of self-propagating remote exploits, it distinguishes itself through several interesting features:
Witty was the first widely propagated Internet worm to carry a destructive payload.
Witty was started in an organized manner with an order of magnitude more ground-zero hosts than any previous worm.
Witty represents the shortest known interval between vulnerability disclosure and worm release -- it began to spread the day after the ISS vulnerability was publicized.
Witty spread through a host population in which every compromised host was doing something proactive to secure their computers and networks.
Witty spread through a population almost an order of magnitude smaller than that of previous worms, demonstrating the viability of worms as an automated mechanism to rapidly compromise machines on the Internet, even in niches without a software monopoly.
In this document we share a global view of the spread of the Witty worm, with particular attention to these worrisome features.
http://www.caida.org/analysis/security/witty/
