Loading malware…
WannaCry, also known as WannaCrypt, WanaCrypt0r, and Wcry, is a Windows ransomware worm responsible for a major global outbreak in May 2017. It encrypts victim files using per-file AES keys protected with RSA encryption and presents ransom demands. It also impairs recovery by deleting Windows Volume Shadow Copies, disabling startup recovery, and removing backup-related information. WannaCry autonomously propagates across vulnerable systems by exploiting the SMBv1 vulnerability addressed by Microsoft security update MS17-010, commonly known as EternalBlue. This unauthenticated remote-code-execution exploit enabled rapid spread both within organizations and between exposed networks without user interaction. The outbreak affected more than 300,000 systems across approximately 150 countries and severely disrupted healthcare, manufacturing, government, and other services, notably the United Kingdom's National Health Service. WannaCry has been publicly attributed by multiple governments and security organizations to the DPRK-linked Lazarus Group.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
For instance, the infamous exploit called EternalBlue took advantage of a security vulnerability in Microsoft’s implementation of the Server Message Block (SMB) protocol and launched the biggest ransomware attack in history called WannaCry.
CVE : CVE-2017-0146 Description : Exploits vulnerabilities in Microsoft SMB implementation. The vulnerability is described in CVE-2017-0146 and CVE-2017-0147. Both vulnerabilities were patched in MS17-010 update from March this year. | On Friday May 12th, the WannaCry ransomware was distributed using a worm leveraging the EternalBlue SMB exploit. After successful exploitation, it installs the DoublePulsar backdoor and then proceeds to load the ransomware component.
CVE : CVE-2017-0146 Description : Exploits vulnerabilities in Microsoft SMB implementation. The vulnerability is described in CVE-2017-0146 and CVE-2017-0147. Both vulnerabilities were patched in MS17-010 update from March this year. | On Friday May 12th, the WannaCry ransomware was distributed using a worm leveraging the EternalBlue SMB exploit. After successful exploitation, it installs the DoublePulsar backdoor and then proceeds to load the ransomware component.
the ransomware perpetrators used publicly available exploit code for the patched SMB “EternalBlue” vulnerability, CVE-2017-0145, which can be triggered by sending a specially crafted packet to a targeted SMBv1 server. This vulnerability was fixed in security bulletin MS17-010 | Threats like WannaCrypt (also known as WannaCry, WanaCrypt0r, WCrypt, or WCRY) ... used publicly available exploit code for the patched SMB “EternalBlue” vulnerability, CVE-2017-0145.
One example of this is wormable ransomware attacks that take advantage of Windows vulnerabilities to propagate throughout a network. WannaCry ransomware leveraged this method in 2017, and in a recent security advisory, Microsoft warned of a newly disclosed remote desktop services vulnerability that adversaries could use for a similar attack... patches for some vulnerabilities such as Common Vulnerabilities and Exposures (CVE) CVE-2019-0708, or MS17-010, and patches for the remote desktop vulnerability and WannaCry, respectively, are all vital to apply.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Lazarus is linked to several high-profile incidents, including the 2014 Sony Pictures attack and the WannaCry ransomware outbreak.”
Five years ago, the WannaCry ransomware cryptoworm targeted computers running Microsoft Windows, encrypting data at organizations around the world.
WannaCry paralysed computers running mostly older versions of Microsoft Windows by encrypting users' computer files and displaying a message demanding anywhere from $US300 to $US600 to release them; failure to pay would leave the data mangled and likely beyond repair.
The exploit chains in play included EternalBlue, DoublePulsar, and WannaCry, all tools that have been publicly known and patchable for years.
The WannaCry attack was a massive ransomware cyberattack... This ransomware leverages an NSA exploit known as EternalBlue... Wincry was the base of the encryption, but two additional exploits, EternalBlue and DoublePulsar, were used by the malware to make it a cryptoworm.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
TeslaCrypt 4.1b ... used WMIC to delete Shadow Volume Copies from an infected PC... One of [WannaCry's] commands invoked WMIC to delete shadow copies.
EternalBlue required zero user interaction and zero authentication, allowing it to spread laterally across networks at machine speed. The article also recommends restricting internal SMB traffic to limit the blast radius of lateral movement.
60 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware threat for which recovery tools may work under limited conditions, particularly on unpatched Windows systems that have not been rebooted after infection.
Mentioned only as an example of a memorable cyber-threat name; the content provides no behavioral or campaign details.
Ransomware campaign whose authors weaponized the EternalBlue SMBv1 exploit for unauthenticated, machine-speed propagation and lateral movement.
Named only as a benchmark for a major ransomware threat; the content does not describe its functionality or an active campaign.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.