RansomwareATT&CK S0366
WannaCry
Also known as: WanaCrypt0r, WCry, WanaCry
WannaCry was a ransomware worm that spread across the world in May 2017 by exploiting a Windows SMBv1 vulnerability that Microsoft had patched two months earlier (MS17-010). Because it spread on its own from host to host, unpatched networks were hit in hours, including large parts of the UK's National Health Service. Its spread slowed when a researcher registered a domain the malware checked before running, which acted as a kill switch.
- Public attribution and associated actors
- Publicly attributed by the US and UK governments to North Korea; in 2018 the US Department of Justice charged a North Korean programmer over WannaCry and other attacks.As publicly reported:Lazarus Group
- First seen
- 2017
- Platforms
- Windows
- MITRE ATT&CK software entries
- S0366 WannaCry
How it spreads or gets in
- Self-propagated as a worm by exploiting the SMBv1 vulnerability fixed by MS17-010, scanning local and internet addresses on TCP port 445.
Key behaviours
- Encrypted files and demanded payment in Bitcoin.
- Deleted Volume Shadow Copies to block easy recovery.
- Installed itself as a Windows service for persistence.
ATT&CK techniques
- T1210Exploitation of Remote Services
- T1570Lateral Tool Transfer
- T1018Remote System Discovery
- T1543.003Create or Modify System Process: Windows Service
- T1486Data Encrypted for Impact
- T1490Inhibit System Recovery
- T1489Service Stop
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Alert on internal hosts suddenly scanning many addresses on TCP 445.
- Detect shadow-copy deletion commands and mass file renames with a new extension.
- Track hosts still offering SMBv1 so exposure is visible before an outbreak.
Defences that work
- Patch critical remote-code-execution flaws fast; MS17-010 had been available since March 2017.
- Disable SMBv1 and block SMB at the internet edge.
- Segment networks so a worm cannot reach every host from one foothold.
- Keep offline, tested backups.