WannaCry was a piece of ransomware that spread across the world from 12 May 2017, infecting hundreds of thousands of Windows computers in around 150 countries within days. It locked victims' files with encryption and displayed a demand for payment in bitcoin, initially the equivalent of 300 dollars, in exchange for the key to unlock them.
What made WannaCry unusual was that it behaved like a worm: it spread on its own from machine to machine across networks, using a Windows flaw, rather than relying on each victim to open a malicious attachment. It disrupted hospitals, factories, railways and government bodies, and became a reference case for how a single exploit can cause global damage. In December 2017 the United States and the United Kingdom publicly blamed North Korea.
WannaCry in plain terms
Imagine a burglar who, instead of breaking into one house, finds a fault shared by millions of front-door locks. He slips into one home, changes all the cupboard locks, leaves a note demanding payment for the new keys and then uses the same trick on every neighbour's door, all without anyone inviting him in. That is how WannaCry moved through office networks.
The door manufacturer had already sent out a free repair two months earlier, but many owners had not fitted it. Those who had installed the update were safe.
How it spread
WannaCry used an exploit known as EternalBlue, which targeted a weakness in the way Windows handled file sharing over networks. The exploit had been developed by the US National Security Agency and was leaked online in April 2017 by a group calling itself the Shadow Brokers. Microsoft had released a security patch for supported versions of Windows in March 2017, but many organisations had not applied it, and older systems such as Windows XP were no longer supported. After the outbreak Microsoft took the rare step of issuing emergency patches for those older systems too.
Once inside a network, the malware scanned for other vulnerable machines and copied itself to them, encrypting files as it went. This self-spreading design explains the speed of the outbreak.
Impact
Victims ranged from carmakers and telecoms firms to logistics companies and universities. In the UK, the National Health Service was among the hardest hit: many hospital trusts and GP surgeries lost access to systems, thousands of appointments and operations were cancelled, and some ambulances were diverted. Estimates of the total economic damage worldwide vary widely, from hundreds of millions to several billion dollars, and include lost work and recovery costs as well as ransom. The outbreak is often cited in discussions of cybersecurity risk and the cost of delayed updates.
The kill switch and the ransom
On the first day, a British security researcher noticed that the program tried to contact an unregistered web domain before running. He registered the domain, and new infections stopped executing their payload once they could reach it, which slowed the outbreak dramatically. Later variants without this check had less impact.
The ransom was a poor money-maker. Payments went to only a handful of hard-coded bitcoin addresses, so the attackers could not easily tell which victim had paid, and paying often did not restore files. The addresses received only around 140,000 dollars' worth of bitcoin at the time. Because Bitcoin's ledger is public, the addresses were watched by researchers and the media, an early example of blockchain analytics in a cyberattack. In August 2017 the funds were moved out, and were reported to have been converted into Monero, a privacy-focused coin.
Attribution and legal action
In December 2017 the US government formally attributed WannaCry to North Korea, and the UK made the same assessment in the same week. Security researchers had earlier noted code similarities with tools linked to a hacking group often called Lazarus. In September 2018 the US Department of Justice charged a North Korean programmer, Park Jin Hyok, over WannaCry and other attacks, and the Treasury added him to its list of OFAC sanctions targets. North Korea denied involvement.
WannaCry shaped later policy debates about whether intelligence agencies should keep software flaws secret, the importance of patching, and the role of cryptocurrency in ransomware payments. Later groups, such as those behind Ryuk, shifted towards targeted attacks on large organisations with much higher demands. Advice from authorities has stayed consistent: keep systems updated, keep offline backups and run anti-malware tools, so that no ransom has to be considered.