The Demon WannaCry, the Worm That Wept in Bitcoin

Legend

On 12 May 2017 it spread by itself using EternalBlue, the exploit attributed to the NSA and leaked by the Shadow Brokers, and within days hit over 200,000 computers in 150 countries, including the hospitals of the UK's health service. Its run stopped when a researcher registered a domain that acted as a kill switch. The US and UK attributed it to North Korea.

Exorcism

Cast it out by patching (MS17-010 had been out for two months) and disabling SMBv1. Port 445 must never face the internet, and offline backups save the rest.

Technical record

Also known as: WanaCry, WanaCrypt0r, WCry
Circle: Circle III · Ransomware and extortion · Circle I · Worms · Circle V · State espionage
First seen: 2017
Status: Dormant
Weapons (exploited CVEs): Saint EternalBlue, Escaped From the Arsenal
Works: The Great Plague of WannaCry · The Miracle of MalwareTech's Domain

A ransomware worm released on 12 May 2017 that spread automatically via EternalBlue, the exploit attributed to the NSA and leaked by the Shadow Brokers, infecting over 200,000 computers in 150 countries including NHS hospitals. Spread was halted when a researcher registered its kill-switch domain. The US and UK attributed it to North Korea's Lazarus Group.

Sources: attack.mitre.org · attack.mitre.org · justice.gov · MITRE ATT&CK reference S0366