WannaCry Used EternalBlue to Spread Globally, Disrupting Hospitals and Businesses

WannaCry ransomware infected more than 200,000 computers worldwide in a campaign that began on May 12, 2017, disrupting UK NHS hospitals, Telefónica and other organizations. The malware used EternalBlue, an NSA exploit leaked by the Shadow Brokers, to exploit Windows SMB vulnerabilities, including CVE-2017-0145, and spread through Internet-exposed TCP port 445 and internal networks. It encrypted numerous file types and demanded approximately $300 in Bitcoin. Microsoft had addressed the vulnerabilities in its MS17-010 update before the outbreak and subsequently released emergency patches for unsupported Windows XP, Windows 8 and Windows Server 2003 systems.

Researcher MalwareTech registered and sinkholed a kill-switch domain, halting propagation of the primary variant described, but reports of subsequent variants meant organizations could not rely on that intervention alone. F5 Labs and CERT-EU urged organizations to apply MS17-010, disable SMBv1, restrict SMB access, isolate vulnerable systems, segment networks and maintain tested backups; US-CERT also published WannaCry indicators. CERT-EU noted that the wanakiwi recovery tool could potentially recover encryption keys on certain affected systems that had not been rebooted, making recovery dependent on system conditions rather than guaranteed.