WannaCry ransomware attack

Attack

The attack began on Friday, 12 May 2017, with evidence pointing to an initial infection in Asia at 07:44 UTC. The initial infection was likely through an exposed vulnerable SMB port, rather than email phishing as initially assumed. Within a day the code was reported to have infected more than 230,000 computers in over 150 countries.

Organizations that had not installed Microsoft's security update from March were affected by the attack. Those still running unsupported versions of Microsoft Windows, such as Windows XP and Windows Server 2003 were at particularly high risk because no security patches had been released since April 2014 for Windows XP and July 2015 for Windows Server 2003. A Kaspersky Lab study reported, however, that less than 0.1 percent of the affected computers were running Windows XP, and that 98 percent of the affected computers were running Windows 7. In a controlled testing environment, the cybersecurity firm Kryptos Logic found that it was unable to infect a Windows XP system with WannaCry using mainly the exploits, as the payload failed to load, or caused the operating system to crash rather than executing and encrypting files. However, when executed manually, WannaCry continued to operate on Windows XP.

Defensive response

Experts quickly advised affected users against paying the ransom due to no reports of people getting their data back after payment and as high revenues would encourage more of such campaigns. As of 14 June 2017, after the attack had subsided, a total of 327 payments totalling US$130,634.77 (51.62396539 BTC) had been transferred (worth approximately US$3,390,765.29 as of 27 February 2026).

The day after the initial attack in May, Microsoft released out-of-band security updates for end-of-life products Windows XP, Windows Server 2003 and Windows 8; these patches had been created in February, but were previously only available to those who paid for a custom support plan. Organizations were advised to patch Windows and plug the vulnerability in order to protect themselves from the cyber attack. The head of Microsoft's Cyber Defense Operations Center, Adrienne Hall, said that "Due to the elevated risk for destructive cyber-attacks at this time, we made the decision to take this action because applying these updates provides further protection against potential attacks with characteristics similar to WannaCrypt [alternative name to WannaCry]".

Researcher Marcus Hutchins discovered the kill switch domain hardcoded in the malware. Registering a domain name for a DNS sinkhole stopped the attack spreading as a worm, because the ransomware only encrypted the computer's files if it was unable to connect to that domain, which all computers infected with WannaCry before the website's registration had been unable to do. While this did not help already infected systems, it severely slowed the spread of the initial infection and gave time for defensive measures to be deployed worldwide, particularly in North America and Asia, which had not been attacked to the same extent as elsewhere. On 14 May, a first variant of WannaCry appeared with a new and second kill-switch registered by Matt Suiche on the same day. This was followed by a second variant with the third and last kill-switch on 15 May, which was registered by Check Point threat intelligence analysts. A few days later, a new version of WannaCry was detected that lacked the kill switch altogether.

On 19 May, it was reported that hackers were trying to use a Mirai botnet variant to effect a distributed denial-of-service attack on WannaCry's kill-switch domain with the intention of knocking it offline. On 22 May, Hutchins protected the domain by switching to a cached version of the site, capable of dealing with much higher traffic loads than the live site.

Separately, researchers from University College London and Boston University reported that their PayBreak system could defeat WannaCry and several other families of ransomware by recovering the keys used to encrypt the user's data.

It was discovered that Windows encryption APIs used by WannaCry may not completely clear the prime numbers used to generate the payload's private keys from the memory, making it potentially possible to retrieve the required key if they had not yet been overwritten or cleared from resident memory. The key is kept in the memory if the WannaCry process has not been killed and the computer has not been rebooted after being infected. This behaviour was used by a French researcher to develop a tool known as WannaKey, which automates this process on Windows XP systems. This approach was iterated upon by a second tool known as Wanakiwi, which was tested to work on Windows 7 and Server 2008 R2 as well.

Within four days of the initial outbreak, new infections had slowed to a trickle due to these responses.

Attribution

Linguistic analysis of the ransom notes suggested the authors were likely fluent in Chinese and proficient in English, as the versions of the notes in those languages appeared to be human-written while the rest seemed to be machine-translated. According to an analysis by the FBI's Cyber Behavioral Analysis Center, the computer that created the ransomware language files had Hangul language fonts installed, as indicated by the presence of the "\fcharset129" Rich Text Format tag. Metadata in the language files also showed that the computers used to create the ransomware were set to UTC+09:00, a time zone used in Korea.

A security researcher initially posted a tweet referencing code similarities between WannaCry and previous malware. The cybersecurity companies Kaspersky Lab and Symantec stated that the code shares some similarities with malware previously used by the Lazarus Group, which has been linked to North Korea and is believed to have carried out the cyberattack on Sony Pictures in 2014 and a Bangladesh bank heist in 2016. However, these similarities could result from either code reuse by another group or an attempt to misattribute responsibility—as in a cyber false flag operation. A leaked internal NSA memo is also alleged to have linked the creation of the worm to North Korea. Brad Smith, the president of Microsoft, stated he believed North Korea was behind the WannaCry attack, and the UK's National Cyber Security Centre reached the same conclusion.

On 18 December 2017, the United States Government formally announced that it considers North Korea to be the main culprit behind the WannaCry attack. President Donald Trump's Homeland Security Advisor, Tom Bossert, wrote an op-ed in The Wall Street Journal stating, "We do not make this allegation lightly. It is based on evidence." In a press conference the following day, Bossert stated that the evidence indicated that Kim Jong-un had given the order to launch the malware attack. Bossert stated that Canada, New Zealand, and Japan agreed with the United States' assessment of the evidence linking the attack to North Korea, while the United Kingdom's Foreign and Commonwealth Office expressed support for the United States' assertion. North Korea denied responsibility for the cyberattack.

On 6 September 2018, the U.S. Department of Justice (DoJ) announced formal charges against Park Jin-hyok for his alleged involvement in the Sony Pictures hack of 2014. The DoJ stated that Park was a North Korean hacker working as part of a team affiliated with the North Korean Reconnaissance General Bureau. The Department of Justice further claimed this team was also involved in the WannaCry attack, among other activities.

Impact

The ransomware campaign was unprecedented in scale according to Europol, which estimates that around 200,000 computers were infected across 150 countries. According to Kaspersky Lab, the four most affected countries were Russia, Ukraine, India and Taiwan.

One of the largest agencies struck by the attack was the National Health Service hospitals in England and Scotland, and up to 70,000 devices—including computers, MRI scanners, blood-storage refrigerators and theatre equipment—may have been affected. On 12 May, some NHS services had to turn away non-critical emergencies, and some ambulances were diverted. In 2016, thousands of computers in 42 separate NHS trusts in England were reported to be still running Windows XP. In 2018 a report by Members of Parliament concluded that all 200 NHS hospitals or other organisations checked in the wake of the WannaCry attack still failed cybersecurity checks. NHS hospitals in Wales and Northern Ireland were unaffected by the attack.

Nissan Motor Manufacturing UK in Tyne and Wear, England, halted production after the ransomware infected some of their systems. Renault also stopped production at several sites in an attempt to stop the spread of the ransomware. Spain's Telefónica, FedEx and Germany's Deutsche Bahn were hit, along with many other countries and companies worldwide.

The attack's impact is said to be relatively low compared to other potential attacks of the same type and could have been much worse had Hutchins not discovered that a kill switch had been built in by its creators or if it had been specifically targeted on highly critical infrastructure, like nuclear power plants, dams or railway systems.

According to cyber-risk-modelling firm Cyence, economic losses from the cyber attack could reach up to US$4 billion, with other groups estimating the losses to be in the hundreds of millions.

Affected organisations

The following is an alphabetical list of organisations confirmed to have been affected:

• Andhra Pradesh Police, India
• Aristotle University of Thessaloniki, Greece
• Automobile Dacia, Romania
• Boeing Commercial Airplanes
• Cambrian College, Canada
• Chinese public security bureau
• CJ CGV (a cinema chain)
• Dalian Maritime University
• Deutsche Bahn
• Dharmais Hospital, Indonesia
• Faculty Hospital, Nitra, Slovakia
• FedEx
• Garena Blade and Soul
• Guilin University of Aerospace Technology
• Guilin University of Electronic Technology
• Harapan Kita Hospital, Indonesia
• Hezhou University
• Hitachi
• Honda
• Instituto Nacional de Salud, Colombia
• Lakeridge Health, Canada
• LAKS, Netherlands
• LATAM Airlines Group
• MegaFon
• Ministry of Internal Affairs of the Russian Federation
• NHS England
• NHS Scotland
• Nissan Motor Manufacturing UK
• O2, Germany
• Petrobrás
• PetroChina
• Portugal Telecom
• Pulse FM
• Q-Park
• Renault
• Russian Railways
• Sandvik
• Justice Court of São Paulo
• Sberbank
• Shandong University
• State Governments of India
  • Government of Gujarat
  • Government of Kerala
  • Government of Maharashtra
  • Government of West Bengal
• Suzhou Vehicle Administration
• Sun Yat-sen University, China
• Telefónica, Spain
• Yettel Hungary, Hungary
• Telkom (South Africa)
• Timrå Municipality, Sweden
• TSMC, Taiwan
• Universitas Jember, Indonesia
• University of Milano-Bicocca, Italy
• University of Montreal, Canada
• Vivo, Brazil

Reactions

A number of experts highlighted the NSA's non-disclosure of the underlying vulnerability, and their loss of control over the EternalBlue attack tool that exploited it. Edward Snowden said that if the NSA had "privately disclosed the flaw used to attack hospitals when they found it, not when they lost it, the attack may not have happened". British cybersecurity expert Graham Cluley also sees "some culpability on the part of the U.S. intelligence services". According to him and others "they could have done something ages ago to get this problem fixed, and they didn't do it". He also said that despite obvious uses for such tools to spy on people of interest, they have a duty to protect their countries' citizens. Others have also commented that this attack shows that the practice of intelligence agencies to stockpile exploits for offensive purposes rather than disclosing them for defensive purposes may be problematic. Microsoft president and chief legal officer Brad Smith wrote, "Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage. An equivalent scenario with conventional weapons would be the U.S. military having some of its Tomahawk missiles stolen." Russian President Vladimir Putin placed the responsibility of the attack on U.S. intelligence services for having created EternalBlue.

On 17 May 2017, United States bipartisan lawmakers introduced the PATCH Act that aims to have exploits reviewed by an independent board to "balance the need to disclose vulnerabilities with other national security interests while increasing transparency and accountability to maintain public trust in the process".

On 15 June 2017, the United States Congress was to hold a hearing on the attack. Two subpanels of the House Science Committee were to hear the testimonies from various individuals working in the government and non-governmental sector about how the U.S. can improve its protection mechanisms for its systems against similar attacks in the future.

Marcus Hutchins, a cybersecurity researcher, working in loose collaboration with UK's National Cyber Security Centre, researched the malware and discovered a "kill switch". Later globally dispersed security researchers collaborated online to develop open-source tools that allow for decryption without payment under some circumstances. Snowden states that when "NSA-enabled ransomware eats the Internet, help comes from researchers, not spy agencies" and asks why this is the case.

Adam Segal, director of the digital and cyberspace policy program at the Council on Foreign Relations, stated that "the patching and updating systems are broken, basically, in the private sector and in government agencies". In addition, Segal said that governments' apparent inability to secure vulnerabilities "opens a lot of questions about backdoors and access to encryption that the government argues it needs from the private sector for security". Arne Schönbohm, president of Germany's Federal Office for Information Security (BSI), stated that "the current attacks show how vulnerable our digital society is. It's a wake-up call for companies to finally take IT security [seriously]".

United Kingdom

The effects of the attack also had political implications; in the United Kingdom, the impact on the National Health Service quickly became political, with claims that the effects were exacerbated by government underfunding of the NHS; in particular, the NHS ceased its paid Custom Support arrangement to continue receiving support for unsupported Microsoft software used within the organization, including Windows XP. Home Secretary Amber Rudd refused to say whether patient data had been backed up, and Shadow Health Secretary Jon Ashworth accused Health Secretary Jeremy Hunt of refusing to act on a critical note from Microsoft, the National Cyber Security Centre (NCSC) and the National Crime Agency that had been received two months previously.

Others argued that hardware and software vendors often fail to account for future security flaws, selling systems that—due to their technical design and market incentives—eventually won't be able to properly receive and apply patches.

The NHS denied that it was still using XP, claiming only 4.7% of devices within the organization ran Windows XP. The cost of the attack to the NHS was estimated as £92 million in disruption to services and IT upgrades.

After the attack, NHS Digital refused to finance the estimated £1 billion to meet the Cyber Essentials Plus standard, an information security certification organized by the UK NCSC, saying this would not constitute "value for money", and that it had invested over £60 million and planned "to spend a further £150 [million] over the next two years" to address key cyber security weaknesses.

In popular culture

In 2026, Australian producer and DJ Ninajirachi and American musician Porter Robinson released the single "WannaCry", which they originally debuted at the Coachella Valley Music and Arts Festival. The song is written from the perspective of the ransomware, reframing the cyberattack through themes of affection and rejection.