Loading malware…
WannaCry, also known as WannaCrypt, WanaCrypt0r, and WCry, is a Windows ransomware family with self-propagating worm capabilities. Its May 2017 outbreak infected more than 200,000 systems worldwide, disrupting healthcare organizations, businesses, and critical infrastructure, including UK hospitals. The attack has been attributed to North Korea.
WannaCry encrypts user files and demands Bitcoin payments for their decryption. It scans local networks for reachable systems, exploits vulnerable SMBv1 services using EternalBlue, and copies itself onto compromised computers, enabling rapid lateral propagation without user interaction. Microsoft addressed the exploited vulnerabilities in the MS17-010 security update released in March 2017, before the outbreak. WannaCry also uses Tor for command-and-control communications.
A prominent outbreak variant checked an embedded domain as a kill switch. Security researcher MalwareTech registered and sinkholed that domain, curtailing that variant's spread. WannaCry infections have continued to affect legacy operational technology networks, where obsolete Windows systems and restrictions on patching and remediation can allow infections to persist.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The WannaCry outbreak in May 2017 ... resulted from exploiting the EternalBlue vulnerability. | The WannaCry outbreak in May 2017, perhaps the most notorious malware attack of the last few years, resulted from exploiting the EternalBlue vulnerability.
The ransomware perpetrators incorporated publicly-available exploit code for the patched SMB EternalBlue vulnerability, CVE-2017-0145, which can be triggered by sending a specially crafted packet to a targeted SMB server.
CVE : CVE-2017-0146 Description : Exploits vulnerabilities in Microsoft SMB implementation. The vulnerability is described in CVE-2017-0146 and CVE-2017-0147. Both vulnerabilities were patched in MS17-010 update from March this year. | On Friday May 12th, the WannaCry ransomware was distributed using a worm leveraging the EternalBlue SMB exploit. After successful exploitation, it installs the DoublePulsar backdoor and then proceeds to load the ransomware component.
CVE : CVE-2017-0146 Description : Exploits vulnerabilities in Microsoft SMB implementation. The vulnerability is described in CVE-2017-0146 and CVE-2017-0147. Both vulnerabilities were patched in MS17-010 update from March this year. | On Friday May 12th, the WannaCry ransomware was distributed using a worm leveraging the EternalBlue SMB exploit. After successful exploitation, it installs the DoublePulsar backdoor and then proceeds to load the ransomware component.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Lazarus was also linked to the WannaCry ransomware outbreak in May 2017.
On 12 May 2017, WannaCry ransomware began spreading like wildfire through computer networks across the world, encrypting over 200,000 devices across150 countries in 24 hours.
Five years ago, the WannaCry ransomware cryptoworm targeted computers running Microsoft Windows, encrypting data at organizations around the world.
WannaCry paralysed computers running mostly older versions of Microsoft Windows by encrypting users' computer files and displaying a message demanding anywhere from $US300 to $US600 to release them; failure to pay would leave the data mangled and likely beyond repair.
The exploit chains in play included EternalBlue, DoublePulsar, and WannaCry, all tools that have been publicly known and patchable for years.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
EternalBlue required zero user interaction and zero authentication, allowing it to spread laterally across networks at machine speed. The article also recommends restricting internal SMB traffic to limit the blast radius of lateral movement.
61 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A North Korean-attributed worm cited alongside NotPetya as having caused tens of billions of dollars in worldwide damage. Included only as historical context.
Listed as a legacy infection increasingly encountered in operational technology environments. The article does not describe WannaCry’s individual capabilities or exploitation mechanisms; its focus is the operational, safety, and compliance trade-offs involved in cleaning infected industrial systems.
Ransomware mentioned as a historical example of worldwide attacks enabled by the leaked EternalBlue exploit against a Microsoft Windows vulnerability. The article notes that many organizations had not installed the available security patch.
A ransomware threat for which recovery tools may work under limited conditions, particularly on unpatched Windows systems that have not been rebooted after infection.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.