Loading story…
WannaCry encrypted files across organizations worldwide after a worm component exploited the Windows SMBv1 flaw patched in MS17-010, driving rapid propagation beyond initial phishing-based infections. Reported victims included the UK's NHS, Telefónica, Iberdrola, Russia's Interior Ministry, FedEx, and Deutsche Bahn, while hotspots were reported in Ukraine, Taiwan, and later China. Infected systems typically displayed ransom demands of $300 or $600 in Bitcoin, and Microsoft issued emergency patches even for unsupported platforms such as Windows XP as governments and incident responders urged organizations to report infections and patch exposed systems.
Technical analysis found the malware checked a kill-switch domain, scanned local and random external IP ranges, looked for the DoublePulsar backdoor, and used EternalBlue when DoublePulsar was absent to deliver the ransomware payload. WannaCry used RSA-2048 and AES-128 for encryption, deleted shadow copies and recovery artifacts, terminated database and Exchange-related processes, and communicated with Tor hidden services over an encrypted protocol. Later reporting indicated Windows 7 and Windows Server 2008 accounted for most infections, while many XP systems crashed instead of reliably propagating the worm; researchers also noted the kill-switch likely prevented far more infections and that shared Bitcoin wallets reduced confidence that paying victims would be consistently decrypted.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
13 events from the most recent confirmed update back to the earliest known activity.
On 2017-12-19, the United States and United Kingdom publicly blamed North Korea for the WannaCry ransomware attack. This marked a significant official attribution development months after the initial outbreak.
On 2017-06-14, Microsoft released additional out-of-band security updates for unsupported Windows versions including Windows XP and Windows Server 2003, warning of elevated risk of destructive attacks similar to WannaCry. The updates addressed 16 vulnerabilities, most rated critical, amid concern over leaked NSA exploit tools such as EternalBlue.
By 2017-05-30, researchers reported that Windows XP systems often crashed with a blue screen instead of successfully installing or spreading WannaCry via the common SMB exploit path. The analysis indicated most infections were concentrated on Windows 7 and Windows Server 2008 rather than XP.
On 2017-05-23, reporting cited nearly 1 million infected computers observed in China, indicating a significant regional surge after the initial global outbreak. Analysts linked the scale in part to slower adoption of newer Windows versions.
By 2017-05-18, security researchers reported a WannaCry implementation flaw that could help some victims recover files under limited conditions. The finding suggested decryption or recovery might be possible for certain affected Windows systems.
On 2017-05-16, researchers reported code similarities between an early WannaCry sample and malware previously associated with the Lazarus Group, prompting investigation into a possible North Korean connection. Multiple security firms said the overlap was noteworthy, though attribution remained unconfirmed at the time.
On 2017-05-15, Check Point reported a new WannaCry kill switch and sinkhole activity, indicating defenders were tracking variant behavior beyond the initial domain registration. This reflected ongoing technical analysis and containment efforts as the campaign evolved.
On 2017-05-13, Germany's Federal Office for Information Security called on affected organizations to report WannaCry infections and apply available patches. The agency framed the outbreak as a wake-up call for stronger long-term cybersecurity practices.
On 2017-05-13, researchers registered a WannaCry kill-switch domain checked by the worm, which significantly curtailed further spread of the initial variant. Later reporting estimated this action may have prevented millions of additional infections.
During the outbreak, Microsoft released emergency security updates for unsupported systems including Windows XP to help defend against WannaCry. This was an extraordinary response because XP had been out of normal support since 2014.
As the outbreak unfolded, victims reported across multiple countries included the UK's NHS, Telefónica, Iberdrola, Russia's Interior Ministry, FedEx, Deutsche Bahn, and organizations in Ukraine and Taiwan. The incident caused broad operational disruption in enterprises and public institutions.
Beginning on the evening of 2017-05-12, the WCry/WannaCry ransomware campaign spread rapidly worldwide, encrypting files and demanding roughly $300 in Bitcoin. Its rapid propagation was driven by an SMB worm exploiting the SMBv1 flaws addressed in MS17-010.
On 2017-03-14, Microsoft released bulletin MS17-010 to fix Windows SMBv1 vulnerabilities later used by WannaCry's worm component. Systems that had applied this update were reported as protected from the main propagation method.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
18 references tracked. Mallory keeps watching after this page renders.
sophos.com
Open sourcetechcrunch.com
Open sourcescworld.com
Open sourcetechcrunch.com
Open sourceheise.de
Open sourcebleepingcomputer.com
Open sourceblog.talosintelligence.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **WannaCry** (`WanaCrypt0r 2.0`) ransomware outbreak encrypted tens of thousands of computers across roughly 99 to 100 countries, disrupting organizations including UK NHS hospitals, Telefónica, and FedEx. The malware demanded a **$300** ransom and spread by exploiting a Windows vulnerability tied to offensive tools allegedly used by the NSA and later leaked by the Shadow Brokers. Microsoft had already released fixes for supported Windows versions, but many victims had not applied them, and the scale of the incident prompted the company to take the unusual step of issuing emergency patches for legacy platforms including **Windows XP**, **Windows 8**, and **Windows Server 2003**. Investigators said the attackers had collected only about **$20,000** in bitcoin in the early stages, with payments traced to a small number of monitored wallets, suggesting limited financial returns despite the global disruption. UK officials said they believed the incident was criminal rather than a state attack, while researchers noted that bitcoin's pseudonymous nature could still allow law enforcement to trace funds through exchanges. The outbreak later began to slow after a researcher discovered a **kill switch**, but the incident highlighted the operational risk posed by delayed patching, exposed legacy systems, and the public release of weaponized exploits.
Jun 29, 2026
Sophos reported that the **WantToCry** ransomware is targeting internet-exposed SMB services on ports `139` and `445`, using weak, brute-forced, or stolen credentials to access shared files without deploying malware on the victim host. Instead of encrypting data locally, the attackers copy files over authenticated SMB sessions to attacker-controlled servers, encrypt them remotely, and write the encrypted versions back to the original shares, appending the `.want_to_cry` extension and dropping ransom notes such as `!want_to_cry.txt` or `!Want_To_Cry.txt`. The notes direct victims to qTox or Telegram and typically demand about **$600 in Bitcoin**. Researchers said the technique reduces traditional endpoint detection opportunities because it leaves few host-based artifacts and relies on seemingly normal SMB file operations, though network and authentication traces remain visible. Sophos linked the activity to infrastructure in **Russia, Germany, the United States, and Singapore**, including systems previously associated with **NetSupport RAT** and **LockBit, Qilin, and ALPHV/BlackCat** activity, while noting the ransomware is unrelated to the 2017 **WannaCry** worm despite the similar name. The company said the attacks appear focused on hosts exposing SMB rather than broad enterprise-wide deployment and urged organizations to block inbound SMB, disable **SMBv1** and anonymous access, monitor unusual external SMB activity, and protect backups from SMB-based access.
Jun 29, 2026
Internet-wide scans found the NSA-linked **DoublePulsar** SMB backdoor on tens of thousands of exposed Windows systems after Shadow Brokers released offensive tooling tied to the implant. Researchers reported infection estimates ranging from roughly 30,000 to more than 120,000 hosts, with infected machines responding to distinctive traffic over port `445`; Microsoft questioned the early counts, but independent investigators said the backdoor had spread rapidly and Countercept later published a method to remotely remove it. Because DoublePulsar operates in memory and leaves no files on disk, it was described as unusually stealthy even as defenders raced to identify and clean compromised systems. Subsequent reporting showed the impact of the leak extended well beyond the initial infections. Symantec said a China-linked group known as **Buckeye/APT3** had used a DoublePulsar variant and related NSA exploit code in real-world attacks as early as March 2016, indicating the capabilities were exposed or replicated long before the public dump. Other leaked SMB exploits, including **EternalChampion**, **EternalRomance**, and **EternalSynergy**, were later ported to work across Windows versions from 2000 through modern releases, while related Shadow Brokers tools such as **EternalBlue** were tied to major outbreaks including **WannaCry** and **NotPetya**, reinforcing the urgency of applying Microsoft’s `MS17-010` patches.
Jun 29, 2026