ransomware-group-operationoperational-disruptionwidely-deployed-product-advisoryweaponized-exploit-availability

WannaCry Ransomware Exploited Unpatched Windows Systems Worldwide

Threat Actor Intelligence · 55 sources · Updated 4mo ago · First seen Apr 24, 2026

The WannaCry (WanaCrypt0r 2.0) ransomware outbreak encrypted tens of thousands of computers across roughly 99 to 100 countries, disrupting organizations including UK NHS hospitals, Telefónica, and FedEx. The malware demanded a $300 ransom and spread by exploiting a Windows vulnerability tied to offensive tools allegedly used by the NSA and later leaked by the Shadow Brokers. Microsoft had already released fixes for supported Windows versions, but many victims had not applied them, and the scale of the incident prompted the company to take the unusual step of issuing emergency patches for legacy platforms including Windows XP, Windows 8, and Windows Server 2003.

Investigators said the attackers had collected only about $20,000 in bitcoin in the early stages, with payments traced to a small number of monitored wallets, suggesting limited financial returns despite the global disruption. UK officials said they believed the incident was criminal rather than a state attack, while researchers noted that bitcoin's pseudonymous nature could still allow law enforcement to trace funds through exchanges. The outbreak later began to slow after a researcher discovered a kill switch, but the incident highlighted the operational risk posed by delayed patching, exposed legacy systems, and the public release of weaponized exploits.

Know this adversaryTTPs, infrastructure, and targeting history in one profile.

Get the profile

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

21 events · Mar 14, 2017 – Mar 28, 2018

Mar 28, 20189y ago
Boeing Charleston plant reportedly hit by WannaCry
Boeing reportedly responded to a WannaCry infection at its Charleston, South Carolina production plant, issuing an internal alert as the malware spread from North Charleston systems. The incident raised concerns about disruption to 777 automated spar assembly tools and possible spread to equipment involved in airplane testing.
Boeing production plant hit with WannaCry ransomware attack - The Verge
Dec 19, 20179y ago
US and UK publicly attribute WannaCry to North Korea's Lazarus Group
The United States and United Kingdom publicly said WannaCry was carried out by North Korean actors, identifying the Lazarus Group and saying it was highly likely backed by the North Korean government. The announcement marked a significant shift from earlier uncertainty over who was responsible for the outbreak.
Facebook action hints at western retaliation over WannaCry attack | North Korea | The Guardian
Oct 27, 20179y ago
UK audit says NHS could have avoided much of WannaCry impact
A National Audit Office report found the NHS was unprepared for the WannaCry attack and said the disruption could have been largely prevented with basic cybersecurity practices, including patching and supported systems. The report documented how the outbreak affected NHS organizations and criticized longstanding IT security weaknesses.
NHS could have avoided WannaCry hack with 'basic IT security', says report | Malware | The Guardian
May 25, 20179y ago
Flashpoint linguistic analysis suggests Chinese-speaking WannaCry authors
Flashpoint published an analysis of WannaCry's 28 embedded ransom notes and found that most non-English and non-Chinese versions appeared machine-translated, while the English and especially the Chinese notes showed signs of human authorship. The firm said with high confidence that the note authors were fluent in Chinese and familiar with English, and assessed with moderate confidence that the Chinese note may have been the original source text.
Flashpoint - Linguistic Analysis of WannaCry Ransomware Suggests Chinese-Speaking Authors
May 21, 20179y ago
Telkom discloses WannaCry disruption to its systems
South African telecom provider Telkom was reported to have systems crippled by the WannaCry ransomware outbreak. The disclosure added Telkom as a specifically identified victim affected by the global campaign.
Telkom systems crippled by WannaCry ransomware
May 19, 20179y ago
Researcher releases Wannakey recovery tool for some XP infections
Quarkslab researcher Adrien Guinet released Wannakey, a tool intended to recover WannaCry decryption keys from some infected Windows XP machines without paying the ransom. The method relied on key material potentially remaining in memory if the system had not been rebooted, though early reporting said it had limited validation and might not work in all cases.
Windows XP PCs infected by WannaCry can be decrypted without paying ransom | Ars Technica UK
May 15, 20179y ago
Australian government says eight businesses likely hit by WannaCry
Australian officials said eight Australian businesses were likely affected by WannaCry, while critical infrastructure, government agencies, and the health system had not been impacted at that stage. Authorities warned the threat was ongoing and urged organizations to apply Microsoft patches rather than pay ransoms.
Ransomware attack still looms in Australia as Government warns WannaCry threat not over - ABC News
May 15, 20179y ago
Researchers identify a second WannaCry kill switch and sinkhole
Researchers reported a new WannaCry variant using a different kill-switch domain and set up a new sinkhole to monitor and help blunt its spread. The finding showed attackers had modified the malware after the initial kill switch was triggered, creating a new technical development in the outbreak.
WannaCry Ransomware Attack | Check Point Software
May 15, 20179y ago
Researchers link WannaCry code to Lazarus-linked malware
Researchers including Google’s Neel Mehta, Comae Technologies, and Kaspersky reported code similarities between an early WannaCry sample and malware previously associated with the Lazarus Group. The finding suggested a possible North Korea link, though analysts cautioned that attribution remained unconfirmed at the time.
The WannaCry Ransomware Has a Link to Suspected North Korean Hackers | WIRED
May 14, 20179y ago
Timrå Municipality in Sweden reports WannaCry infections
Timrå Municipality disclosed that around 70 computers had been infected by WannaCry, with officials estimating up to 100 systems could be affected before containment. The incident disrupted some administrative operations, though the municipality said healthcare-related services were not impacted and that it did not pay the ransom.
Timrå kommun drabbat av utpressningsattack | SVT Nyheter
May 14, 20179y ago
Indonesia's Dharmais Hospital confirmed affected by WannaCry
Indonesian officials confirmed that Dharmais Hospital in Jakarta was affected by the WannaCry outbreak, though reports said there was no major impact on patient care. The disclosure identified a new healthcare victim in Asia tied to the global ransomware campaign.
Ransomware’s Aftershocks Feared as U.S. Warns of Complexity - The New York Times
May 14, 20179y ago
Chinese police, petrol stations, and universities report WannaCry disruptions
Reporting said the WannaCry outbreak disrupted systems in China, including police operations, China National Petroleum Corp petrol stations that shifted to cash-only payments, and networks at several universities such as Tsinghua and Peking University. China’s national computer emergency response body, CNCERT, urged Windows users to apply Microsoft patches as public-sector and academic institutions issued warnings.
Chinese police and petrol stations hit by ransomware attack | South China Morning Post
May 13, 20179y ago
Microsoft issues emergency patches for Windows XP and other legacy systems
In an unusual move, Microsoft released public security patches for unsupported or custom-support platforms including Windows XP, Windows 8, and Windows Server 2003. The emergency action was intended to help organizations defend against the ongoing WannaCry attack.
May 13, 20179y ago
Kill switch discovery slows WannaCry spread
A 22-year-old researcher in the UK discovered a kill switch that appeared to slow the ransomware's propagation. This reduced the pace of the outbreak after its initial global surge.
May 13, 20179y ago
Researchers estimate attackers received about $20,000 in ransom
Investigators tracking bitcoin wallets associated with WannaCry estimated that the operators had collected only about $20,000 in ransom payments at that stage. The identified funds were reported to still be sitting in the monitored wallets.
May 13, 20179y ago
UK officials say WannaCry appears to be criminal, not state-directed
During the early response to the outbreak, UK authorities said they believed the incident was a criminal attack rather than an attack by a foreign power. Home Secretary Amber Rudd also said the government did not yet know who was responsible.
May 13, 20179y ago
Renault reports WannaCry disruption at French production sites
French automaker Renault said the WannaCry outbreak affected operations, with reporting indicating production was halted at some sites as a precaution. The disclosure added Renault as a specifically identified manufacturing-sector victim of the global ransomware campaign.
Global cyber attack: A look at some prominent victims | The Straits Times
May 12, 20179y ago
NHS and Scottish health services disclose widespread WannaCry disruption
UK health authorities and hospitals reported major operational disruption from WannaCry, affecting 40 NHS trusts in England, 11 Scottish health boards, and the Scottish ambulance service. Hospitals declared major incidents, shut down IT systems, cancelled routine care, diverted ambulances, and said there was no evidence at that stage that patient data had been compromised.
The NHS trusts hit by malware - full list | NHS | The Guardian
May 12, 20179y ago
Major Spanish firms report WannaCry infections
During the initial WannaCry outbreak, major Spanish companies were reported among the victims, with Telefonica prominently affected and other large firms also taking defensive action or reporting disruption. The disclosures highlighted Spain as one of the early heavily impacted countries in the global campaign.
Global malware infection: Major Spanish firms among victims of massive global cyber attack | Economy and Business | EL PAÍS English
May 12, 20179y ago
WannaCry ransomware outbreak disrupts organizations worldwide
A large WannaCry outbreak hit tens of thousands of computers across roughly 99-100 countries, including UK NHS hospitals, Telefonica, and FedEx. The malware encrypted systems, demanded a $300 ransom, and spread using Windows flaws linked in reporting to exploits exposed by the Shadow Brokers.
Mar 14, 201710y ago
Microsoft releases March patch for Windows SMB vulnerability
Microsoft issued a security update in March 2017 for supported Windows versions to fix the vulnerability later used by WannaCry. Systems that did not apply the patch remained exposed to exploitation.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Malware

1 linked

WannaCry

Affected products

2 linked

Windows XpWindows

Organizations

2 linked

FedEx CorporationTelefónica

Breaches

3 linked

NATIONALHEALTHSERVICE-2017-05UNITEDKINGDOMNATIONALHEALTHSERVICE-2017-05BRITISHNATIONALHEALTHSERVICE-2017-12

Do you run this?See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.

Get the Full Actor Profile

Source coverage

Sources

50 references tracked. Mallory keeps watching after this page renders.

Checkpoint BlogNews · Aug 4, 2025

WannaCry Ransomware Attack | Check Point SoftwareOpen source ↗

BbcNews · Jun 20, 2021

BBC World Service - Cyber Hack, The Lazarus Heist S1, 10. Kill switchOpen source ↗

Cybersecurity DiveNews · May 17, 2021

WannaCry lesson still echoes: Patch | Cybersecurity DiveOpen source ↗

The VergeNews · Mar 28, 2018

Boeing production plant hit with WannaCry ransomware attack - The VergeOpen source ↗

42 additional sources from 12-05-2017 to 19-12-2017

Svt SeNews · May 12, 2017

Timrå kommun drabbat av utpressningsattack | SVT NyheterOpen source ↗

Web ArchiveNews · May 12, 2017

Un ataque inform�tico masivo infecta a las grandes empresas de Espa�aOpen source ↗

Web ArchiveNews · May 12, 2017

Alerta por cibertaque que golpeó a 74 países - Novedades Tecnología - Tecnología - ELTIEMPO.COMOpen source ↗

ForbesNews · May 12, 2017

An NSA Cyber Weapon Might Be Behind A Massive Global Ransomware OutbreakOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News