What is WannaCry Ransomware?

Key takeaways

• WannaCry is a ransomware worm that spread worldwide in May 2017 with no user action required.
• It exploited EternalBlue, a vulnerability in the Windows SMBv1 protocol, to propagate automatically.
• The worm affected an estimated 200,000 systems across 150 countries within days.
• A patch existed before the outbreak, and unpatched, internet-exposed SMB was the condition it needed.
• Microsegmentation blocks the SMB pathways WannaCry used to move between machines.

What is WannaCry ransomware?

WannaCry is a self-propagating ransomware worm, distinct from ransomware that requires phishing or manual deployment. Once present on a network, it scanned for other vulnerable machines and infected them without any human involvement.

What happens when WannaCry infects a computer?

Once WannaCry infiltrates your computer, it installs a "dropper," a small program that unpacks everything needed to carry out the attack. The dropper includes an encryption engine, a set of encryption keys, and a copy of Tor, which the malware uses to discreetly communicate back to its originating threat actors.

From that moment onward, WannaCry makes quick moves to propagate itself and execute the attack. It starts by scanning your hard drive for targeted file types, such as documents, database files, emails, graphics, and source code. It then encrypts sensitive and important files it deems valuable and locks you out of them. A ransom notification appears on your screen demanding a payment in Bitcoin, with a countdown warning that the amount doubles if the deadline passes.

There are certain characteristics that made WannaCry different from typical ransomware attacks. While your files are being encrypted, the infected machine simultaneously scans your network for other systems it can reach and attack over SMB. There's no need for a human to click a link or open an attachment to activate this process. The dual function of encrypting data while also searching for additional victims is what defines WannaCry as a form of ransomware as well as a computer worm.

How did WannaCry ransomware spread?

WannaCry spread by exploiting EternalBlue, a vulnerability in version 1 of the Windows Server Message Block (SMB) protocol. EternalBlue was an exploit developed by a national intelligence agency and later leaked publicly. WannaCry used it to reach any machine running a vulnerable, network-accessible SMB service, infect it, and then repeat the process from that machine. This turned each infected system into a launch point for further infection throughout the local network and the Internet.

The worm needed two conditions: unpatched SMBv1 and open network access to it. Microsoft had released a patch two months before the outbreak, so the organizations hit hardest were those running unpatched systems on flat, permissive networks.

How was the WannaCry ransomware attack stopped?

The outbreak was slowed by accident, not by design.

Marcus Hutchins, a security researcher at Kryptos Logic, identified WannaCry's kill switch in under two hours after it was released. He saw that the malware behind WannaCry was querying a long, random domain name before it started encrypting and realized no one had ever registered that domain name. Based on a gut instinct, he purchased the domain name for $10.69.

Hutchins' registration of the domain created an unintended condition when it came online. As soon as WannaCry detected that the domain existed, it treated each infected device as a “sandbox” and stopped encrypting. This stopped new infections, but machines that were already encrypted stayed locked.

This reprieve was short-lived. Within days, new WannaCry variants appeared with different kill switches or none at all. That is the takeaway: an accidental coding flaw bought time, but patching MS17-010 and blocking open SMB traffic were the only durable fixes.

WannaCry was eventually attributed to the Lazarus Group, a North Korean state-sponsored malicious cyber group. Security researchers initially noticed similarities in the malware's code that closely resembled past attacks by the group. Thanks to work by companies like Microsoft and intelligence agencies in the United States, the UK, and other allies, these digital traces were analyzed to confirm the responsible group. Soon after, they were charged with conspiracy to conduct multiple cyberattacks and intrusions.

What was the impact of WannaCry?

WannaCry caused widespread operational disruption in a matter of days. In the United Kingdom, the National Health Service canceled appointments and procedures because systems were locked. Similarly, manufacturers, telecommunications firms, and logistics companies all experienced network failures as the worm propagated through their networks. The breadth of the damage came from automatic propagation, which let the infection spread far beyond the initial points of compromise.

Is WannaCry ransomware still a threat?

WannaCry is no longer spreading at the level of 2017, but variants still circulate and occasionally infect unpatched systems. However, the lessons learned about how these types of threats operate remain relevant. Wormable ransomware that exploits a network protocol depends on internal reachability, and any environment that leaves SMB or similar protocols open between machines remains exposed to attacks that follow the same pattern.

How do you contain a WannaCry-style attack?

You contain a WannaCry-style ransomware attack by closing the network protocol it uses to move between machines. Patching removes the specific vulnerability. Segmentation removes the open pathway that any wormable threat requires, including future ones that exploit different flaws.

Microsegmentation permits only necessary traffic between workloads and blocks protocols such as SMB from moving freely across the environment. A worm that lands on one machine cannot reach the next, because the port and protocol it depends on are closed by policy. Propagation stops at the first host. This is breach containment applied to a self-spreading threat, and it holds even when a machine is unpatched.

What cybersecurity lessons did WannaCry teach?

WannaCry was more than a ransomware outbreak that infiltrated over 200,000 computers. It was essentially a stress test, and almost every enterprise that tried to pass it ultimately failed. It exposed the gap between how organizations actually defend their environments and how well defended they believe they are.

• A patch only protects what it reaches: Microsoft issued the fix two months prior to the WannaCry outbreak; however, millions of machines were still left vulnerable. An unapplied patch on even a small fraction of the fleet leaves an opening an attacker can use.
• Legacy systems do not quietly retire: Systems that are no longer supported by vendors cannot receive patches or updates, which makes legacy infrastructure a permanent gap in your defenses.
• Flat networks turn one bad machine into a company-wide crisis: WannaCry moved across the enterprise at network speed because internal communication between devices was largely unrestricted. According to Cisco research, lateral movement is involved in up to 70% of all successful breaches, with this often occurring within minutes of an attacker first gaining access to a system.
• Microsegmentation shrinks the blast radius: Microsegmentation restricts communication between specific workloads. If a workstation is infected, it cannot reach its next target, whether or not that target is patched.
• A single control is never enough: You should always have multiple layers of protection and a well-tested backup or disaster recovery plan. Patches fail, security tools miss threats, and no organization should count on another accidental kill switch.

How does Illumio help stop ransomware from spreading?

Ransomware becomes a major disruption when it moves from one system to another. Illumio Segmentation restricts unnecessary connections and isolates compromised systems, while Illumio Insights helps teams detect suspicious lateral movement and respond quickly.

Together, these capabilities contain ransomware, reduce its potential blast radius, and help prevent a single compromised system from becoming an organization-wide outage.

FAQs about WannaCry ransomware

What type of malware is WannaCry?

WannaCry is a ransomware worm, which combines file-encrypting ransomware with the ability to spread automatically across networks without user action.

How did WannaCry spread?

WannaCry exploited EternalBlue, a vulnerability in the Windows SMBv1 protocol, to infect vulnerable machines and then propagate from each one to others automatically.

Is WannaCry still a threat?

Although WannaCry is no longer spreading as it did in 2017, variants still exist that can infect unpatched computer systems, and the way WannaCry spread remains a real threat.

Can microsegmentation stop a WannaCry-style attack?

Yes, microsegmentation blocks the SMB pathways WannaCry used to move between machines, stopping propagation at the first host even when a system is unpatched.