WannaCry ransomware attack

WannaCry
Wana Decrypt0r screenshot.png
Screenshot of the ransom note left on an infected system
Date 12 May 2017 – 15 May 2017
(initial outbreak) [1]
Location Worldwide
Also known as Transformations:
Wanna → Wana
Cryptor → Crypt0r
Cryptor → Decryptor
Cryptor → Crypt → Cry
Addition of "2.0"
Short names:
Wanna → WN → W
Cry → CRY
Type Cyberattack
Theme Ransomware encrypting files with $300 – $600 demand (via bitcoin)
Cause
  • WannaCry worm
Outcome Over 200,000 victims and more than 300,000 computers infected [2] [3] [4]

The WannaCry ransomware attack was a May 2017 worldwide cyberattack by the WannaCry [a] ransomware cryptoworm, which targeted computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in the Bitcoin cryptocurrency.

The attack began on Friday, 12 May 2017, [5] and within a day was reported to have infected more than 230,000 computers in over 150 countries. [6] [7] Parts of the United Kingdom's National Health Service (NHS) were infected, causing it to run some services on an emergency-only basis during the attack, [8] Spain's Telefónica, FedEx and Deutsche Bahn were hit, along with many other countries and companies worldwide. [9] [10] [11] Shortly after the attack began, Marcus Hutchins, a 22-year-old web security researcher from North Devon in England then known as MalwareTech [12] discovered an effective kill switch by registering a domain name he found in the code of the ransomware. This greatly slowed the spread of the infection, effectively halting the initial outbreak on Monday, 15 May 2017, but new versions have since been detected that lack the kill switch. [13] [14] [15] [16] Researchers have also found ways to recover data from infected machines under some circumstances. [17]

WannaCry propagates using EternalBlue, an exploit of Windows' Server Message Block (SMB) protocol. Much of the attention and comment around the event was occasioned by the fact that the U.S. National Security Agency (NSA) had already discovered the vulnerability, but used it to create an exploit for its own offensive work, rather than report it to Microsoft. [18] [19] Microsoft eventually discovered the vulnerability, and on Tuesday, March 14, 2017, they issued security bulletin MS17-010, which detailed the flaw and announced that patches had been released for all Windows versions that were currently supported at that time, these being Windows 7, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2012, and Windows Server 2016, in addition to Windows Vista (which had recently ended support). [20] However, many Windows users had not installed the patches when, two months later on May 12, 2017, WannaCry used the EternalBlue vulnerability to spread itself. The next day, Microsoft released emergency security patches for Windows 7 and Windows 8.

Those still running older, unsupported versions of Microsoft Windows, such as Windows XP and Windows Server 2003, were initially at particular risk, but Microsoft released an emergency security patch for these platforms as well. [21] Almost all victims of the cyberattack were running Windows 7, prompting a security researcher to argue that its effects on Windows XP users were "insignificant" in comparison. [22] [17]

Within four days of the initial outbreak, security experts said that most organizations had applied updates, and that new infections had slowed to a trickle. [23]

Several organizations released detailed technical writeups of the malware, including Microsoft, [24] Cisco, [25] Malwarebytes, [26] Symantec and McAfee. [27]

The "payload" works in the same fashion as most modern ransomware: it finds and encrypts a range of data files, then displays a "ransom note" informing the user and demanding a payment in bitcoin. [28] It is considered a network worm because it also includes a "transport" mechanism to automatically spread itself. This transport code scans for vulnerable systems, then uses the EternalBlue exploit to gain access, and the DoublePulsar tool to install and execute a copy of itself. [25]

Description

The WannaCry ransomware attack was a May 2017 worldwide cyberattack by the WannaCry [b] ransomware cryptoworm, which targeted computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in the Bitcoin cryptocurrency. [32]

Other Languages
български: WannaCry
bosanski: WannaCry
català: WannaCry
čeština: WannaCry
Deutsch: WannaCry
eesti: WannaCry
Ελληνικά: WannaCry
فارسی: واناکرای
français: WannaCry
한국어: 워너크라이
Հայերեն: WannaCry
italiano: WannaCry
עברית: WannaCry
lietuvių: WannaCry
lumbaart: WannaCry
magyar: WannaCry
မြန်မာဘာသာ: WannaCry ransomware attack
Nederlands: WannaCry
日本語: WannaCry
polski: WannaCry
português: WannaCry
română: WannaCry
русский: WannaCry
slovenčina: WannaCry
српски / srpski: WannaCry
srpskohrvatski / српскохрватски: WannaCry
suomi: WannaCry
svenska: WannaCry
тоҷикӣ: WannaCry
Türkçe: WannaCry
українська: WannaCry
粵語: WannaCry
中文: WannaCry