The Infamous WannaCry Ransomware
WannaCry: Global Ransomware Outbreak Leveraging EternalBlue
WannaCry is one of the most infamous ransomware attacks in history. Launched in May 2017, it spread rapidly across the globe by exploiting a vulnerability in Windows (SMBv1) known as EternalBlue, encrypting data on infected machines and demanding Bitcoin payments for file recovery. It crippled critical infrastructure, especially in healthcare, and served as a wake-up call for how fast malware could scale through unpatched systems. Wannacry ransomware is also known as Ransom.Wannacry, WannaCryptor, WannaCrypt, and WCRY.
Introduction to WannaCry
Unlike traditional ransomware, WannaCry behaves like a worm—spreading automatically from one vulnerable system to another with no user interaction. It exploits CVE-2017-0144, a vulnerability in Microsoft’s SMB protocol, initially developed as a cyberweapon by the NSA and later leaked by a group known as Shadow Brokers. WannaCry combined ransomware and worm-like propagation to infect over 200,000 systems in more than 150 countries within days.
1. How WannaCry Works
Infection Mechanism:
WannaCry scans networks for systems using SMBv1 and leverages the EternalBlue exploit to gain access. Once a system is infected, it begins scanning for other targets, making it self-propagating within local and wide-area networks.
Payload Execution:
Once inside a system, WannaCry:
- Encrypts files using RSA and AES encryption
- Changes file extensions to .WNCRY
- Displays a ransom note demanding $300–$600 in Bitcoin
- Includes a countdown timer and threats of permanent data loss
- Attempts to spread to nearby machines using the same exploit
It also installs a killswitch check—a domain that, if registered, stops the malware from spreading.
2. History and Notable Campaigns
Origin and Discovery:
WannaCry appeared on May 12, 2017, and quickly made headlines as it took down hospitals, telecoms, and businesses across the globe. Researchers discovered that it used NSA-developed code, which had been leaked a month earlier.
Notable Campaigns:
- UK’s National Health Service (NHS) suffered major outages, with hospitals canceling surgeries and diverting patients
- Spain’s Telefónica, Germany’s Deutsche Bahn, and FedEx were also hit
- Over 300,000 machines infected within a week
- A cybersecurity researcher accidentally triggered a killswitch by registering a domain hardcoded in the malware, slowing its spread
3. Targets and Impact
Targeted Victims and Sectors:
WannaCry primarily affected:
- Public sector institutions, including hospitals and universities
- Large corporations with legacy Windows systems
- Countries with low patching adoption, including Russia, India, and China
Consequences:
- Millions of dollars in damages from downtime and recovery
- Patient care disrupted, especially in healthcare
- Reputational damage to affected organizations
- Accelerated global awareness of cyber hygiene and patching practices
4. Technical Details
Payload Capabilities:
- Encrypts more than 170 file types
- Creates ransom notes in multiple languages
- Installs itself in the Windows directory for persistence
- Uses Tor for anonymity in payment tracking
- Exploits both EternalBlue and DoublePulsar backdoor
Evasion Techniques:
- Worm-like spreading avoids reliance on phishing emails
- Encryption payload activates after network infection, bypassing perimeter AV
- Propagation speed overwhelms incident response teams
- Killswitch domain used as an emergency shutdown (though not intentionally by the attackers)
5. Preventing WannaCry Infections
Best Practices:
- Apply critical Windows security patches, especially MS17-010
- Disable SMBv1 protocol on all systems
- Use firewalls to block SMB traffic over the internet
- Implement network segmentation to limit worm propagation
- Back up data regularly and store backups offline
Recommended Security Tools:
- Enterprise-grade endpoint protection (e.g., CrowdStrike, Sophos, Microsoft Defender)
- Vulnerability scanners (e.g., Nessus, OpenVAS)
- Patch management systems
- Intrusion detection and prevention systems (IDPS)
6. Detecting and Removing WannaCry
Indicators of Compromise (IoCs):
- Files renamed with .WNCRY extension
- Presence of @Please_Read_Me@.txt ransom note
- Unexpected communication with Tor addresses or the killswitch domain
- SMB traffic anomalies on port 445
Removal Steps:
- Isolate infected systems immediately
- Do not reboot—doing so may remove volatile forensic evidence
- Use decryption tools if backups are unavailable (though many systems couldn’t be decrypted)
- Patch all systems before reconnecting
- Restore from clean, offline backups
Professional Help:
If WannaCry hits an organization, especially in healthcare or finance, engaging a cybersecurity incident response team is critical. Even with the killswitch active, variants and copycats still pose a risk.
7. Response to a WannaCry Infection
Immediate Steps:
- Disconnect infected machines from the network
- Activate incident response protocols
- Begin communication with stakeholders and law enforcement
- Assess impact and determine if systems can be restored from backups
- Patch unaffected systems to prevent lateral spread
8. Legal and Ethical Implications
Legal Considerations:
Organizations that suffered from WannaCry may have faced scrutiny over failure to apply critical patches. Data breach reporting laws may also apply, especially if sensitive data was exposed or lost.
Ethical Considerations:
WannaCry exploited known but unpatched vulnerabilities—raising questions about vendor responsibility, government hoarding of exploits, and system owner negligence. Its use of ransomware to disrupt hospitals also crossed ethical red lines.
9. Resources and References
- Microsoft Security Bulletin: MS17-010 Patch Info
- MalwareTech: The accidental killswitch discovery
- CISA: SMB Best Practices
- MITRE ATT&CK Techniques: T1486 (Data Encryption), T1210 (Exploitation of Remote Services)
10. FAQs about WannaCry
Q: What is WannaCry ransomware?
A ransomware worm that encrypts files and spreads via a Windows SMB vulnerability.
Q: How did WannaCry spread so fast?
By using the EternalBlue exploit, it could infect vulnerable machines automatically, without user action.
Q: Can WannaCry still infect systems today?
If a system remains unpatched and SMBv1 is enabled, it's still theoretically vulnerable—especially to WannaCry variants.
Q: Was the ransom effective?
Most victims did not recover their files, even if they paid. Payment tracking showed few actual decryptions.
11. Conclusion
WannaCry changed the game. It exposed how dangerous unpatched vulnerabilities can be at scale, and how ransomware can go from targeted attacks to global chaos in hours. The lessons from 2017 are still relevant today: patch fast, back up data, and never assume a legacy system is safe. WannaCry didn’t just encrypt data—it encrypted complacency and forced the world to pay attention.
« Back to the Virus Information Library