WannaCry spread worldwide via SMB worm exploiting MS17-010

WannaCry encrypted files across organizations worldwide after a worm component exploited the Windows SMBv1 flaw patched in MS17-010, driving rapid propagation beyond initial phishing-based infections. Reported victims included the UK's NHS, Telefónica, Iberdrola, Russia's Interior Ministry, FedEx, and Deutsche Bahn, while hotspots were reported in Ukraine, Taiwan, and later China. Infected systems typically displayed ransom demands of $300 or $600 in Bitcoin, and Microsoft issued emergency patches even for unsupported platforms such as Windows XP as governments and incident responders urged organizations to report infections and patch exposed systems.

Technical analysis found the malware checked a kill-switch domain, scanned local and random external IP ranges, looked for the DoublePulsar backdoor, and used EternalBlue when DoublePulsar was absent to deliver the ransomware payload. WannaCry used RSA-2048 and AES-128 for encryption, deleted shadow copies and recovery artifacts, terminated database and Exchange-related processes, and communicated with Tor hidden services over an encrypted protocol. Later reporting indicated Windows 7 and Windows Server 2008 accounted for most infections, while many XP systems crashed instead of reliably propagating the worm; researchers also noted the kill-switch likely prevented far more infections and that shared Bitcoin wallets reduced confidence that paying victims would be consistently decrypted.