WannaCry ransomware attack (May 2017)

How it worked

WannaCry combined two common components of modern cyberattacks: an exploit that allowed remote code execution and ransomware that scrambled data. The exploit, widely reported as "EternalBlue," targeted unpatched SMB services. Once inside a network, the worm scanned for other vulnerable hosts and infected them without further user interaction. The ransomware portion encrypted files and replaced desktop backgrounds with a demand that victims pay roughly $300 in Bitcoin, with a higher amount requested after a deadline. The malware’s ransom notice also included instructions and a countdown threatening file loss.

Spread, containment and timeline

The infection spread rapidly across many countries and organizations, especially where systems had not received recent security updates. Security researchers and incident responders tracked the outbreak, and in the early stages a researcher discovered a so‑called "kill switch" domain whose registration and activation significantly slowed propagation. Microsoft had previously released security updates addressing the exploited flaw and issued additional emergency patches for older, unsupported versions of Windows after the outbreak began.

Impact and response

WannaCry affected a wide range of organizations, causing operational disruption and financial costs from remediation, downtime, lost productivity and recovery efforts. The incident emphasized common lessons in cybersecurity: the importance of timely patching, network segmentation, reliable backups, and incident response planning. Governments and private sector groups used the event to reassess defensive posture and to promote information sharing about large‑scale ransomware risks.

Mitigation and lasting significance

• Keep systems and software up to date with vendor patches.
• Disable or restrict legacy protocols such as SMBv1 where possible.
• Maintain tested offline backups and recovery procedures.
• Use network segmentation, strong access controls and endpoint protection.

WannaCry became a high‑profile example of how unpatched vulnerabilities and automated worms can cause widespread harm. Its legacy is a stronger emphasis on basic cyber hygiene and coordinated response to ransomware incidents. For technical background on encryption concepts used by ransomware, see encryption.