What is WannaCry ransom­ware?

WannaCry is a ransom­ware that was re­spons­ible for billions of dollars in damages worldwide in 2017. A security leak in Windows led to the attack, which targeted gov­ern­ment agencies and large cor­por­a­tions.

What is WannaCry?

In May 2017, one of the worst ransom­ware attacks globally occurred. The malware re­spons­ible for this incident went by various names, including Wana Decrypt0r 2.0, Wan­naC­rypt, WCRY or Wcrypt, among others. However, the most widely re­cog­nised name for this cy­ber­at­tack remains WannaCry. It impacted a stag­ger­ing number of systems, infecting over 230,000 computers across nearly 150 countries, en­crypt­ing files and even entire operating systems. Victims were coerced into paying a Bitcoin ransom for file de­cryp­tion, although au­thor­it­ies strongly dis­cour­aged such payments.

The gateway for WannaCry was a security vul­ner­ab­il­ity in Windows known as MS17-010. This flaw was exploited using the Etern­al­Blue exploit, re­portedly developed by the US in­tel­li­gence agency NSA and used for its own purposes for an extended period. It wasn’t until a hacker group disclosed the vul­ner­ab­il­ity that Microsoft became aware and attempted to address it with a security patch in March 2017. Un­for­tu­nately, due to com­pat­ib­il­ity issues with some systems and users neg­lect­ing updates, WannaCry, the successor to Etern­al­Blue, managed to propagate re­l­at­ively unchecked two months later.

What is WannaCry targeting?

WannaCry encrypts important files, ef­fect­ively locking users out of their data, and delivers a ransom message demanding money. The hackers’ primary motive is financial gain, initially demanding $300 (around £250) in 2017 for data release. If victims failed to pay promptly, the ransom doubled. Because WannaCry autonom­ously rep­lic­ates itself and spreads through file-sharing protocols, its potential impact and profits escalated rapidly. Tens of thousands of computers were being infected hourly in 2017. Notably, even after paying the ransom, victims often did not regain access to their data as promised.

How much damage did WannaCry cause?

The damage caused by WannaCry cannot be precisely quan­ti­fied. Experts estimate it to be several billion US dollars. The sub­stan­tial financial impact of WannaCry wasn’t solely from ransom payments. This malware targeted not only in­di­vidu­als but also numerous busi­nesses, gov­ern­ment agencies, and public in­sti­tu­tions, often causing wide­spread system dis­rup­tions. For instance, it severely impacted the National Health Service (NHS), leading to the post­pone­ment of critical op­er­a­tions, loss of access to patient records, and incorrect in­form­a­tion provided to am­bu­lances. At its peak, over 30 percent of NHS hospitals were affected by WannaCry.

In Germany, Deutsche Bahn ex­per­i­enced sig­ni­fic­ant dis­rup­tions, with display boards and video sur­veil­lance failing at many train stations. The Russian Railway Company faced similar issues. In Spain, WannaCry caused re­stric­tions in Tele­fón­ica’s telephone network. Other affected companies included FedEx, Honda, and Renault. Ad­di­tion­ally, gov­ern­ment entities like the Romanian Ministry of Foreign Affairs, uni­ver­sit­ies in Montreal and Thes­saloniki, and the São Paulo Justice Court were targeted. It’s likely that these or­gan­isa­tions didn’t update their systems in a timely manner, leaving them vul­ner­able to WannaCry’s attack, which struck before necessary updates could be im­ple­men­ted.

Is WannaCry still a threat?

For­tu­nately, the massive 2017 WannaCry attack lasted only a few days. During the in­vest­ig­a­tion, British cy­ber­se­cur­ity expert Marcus Hutchins dis­covered an emergency shutdown switch in­ten­tion­ally or ac­ci­dent­ally embedded in the malware’s code. Hutchins suc­cess­fully re­gistered a domain to trigger this switch, ef­fect­ively shutting down WannaCry. However, the threat hasn’t dis­ap­peared entirely, as newer versions of WannaCry continue to circulate without the emergency switch. Still, given that they exploit the same Windows vul­ner­ab­il­ity, measures have been taken to minimise the risk from this par­tic­u­lar type of malware. Yet, it’s worth noting that other malware strains can pose even greater dangers.

How to protect yourself from ransom­ware like WannaCry

Even though ransom­ware is con­stantly evolving, there are good tactics you can use to protect your system from attacks with WannaCry or its suc­cessors. For this purpose, it’s possible to remove ransom­ware. Nev­er­the­less, you should def­in­itely pay attention to the following:

• Cur­rent­ness: Always keep your system up to date. Regularly updating your computer not only keeps it running smoothly but also closes off many potential entry points for ransom­ware like WannaCry. The discussed ransom­ware exploited an entry point that Microsoft had already patched. Only those who had not yet installed this security update fell victim to the attack.
• Security software: Protect your system with a suitable firewall and use a suitable antivirus program. This way, in addition to ransom­ware, spyware and scareware can also be detected early.
• Check sources: Avoid opening emails from unknown senders or with sus­pi­cious sender names, and refrain from clicking on dubious links. Exercise caution when dealing with USB sticks or other external data devices; only connect them if you’re certain about their contents.
• Backups: Regular backups will not prevent an attack with ransom­ware, but if you become a victim of an attack, the damage will be sig­ni­fic­antly less. They enable you to restore your system to a previous state if en­cryp­tion occurs. Ad­di­tion­ally, there are spe­cial­ised programs that can automate the process of creating regular backups for added pro­tec­tion.