WannaCry, the ransomware attack that changed the history of cybersecurity
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-0144 | Remote Code Execution in Microsoft SMBv1 (EternalBlue) affecting Windows and Siemens devices CVE-2017-0144 is a remote code execution flaw in the SMBv1 server component of Microsoft Windows, commonly known as EternalBlue, and one of the SMB flaws fixed by Microsoft in the March 2017 MS17-010 bulletin. An attacker who can reach the SMB service over the network sends specially crafted packets that trigger memory corruption in the SMBv1 implementation, gaining the ability to execute arbitrary code on the target without user interaction. Successful exploitation yields full system compromise and has been heavily weaponized for wormable spread and ransomware delivery, notably via the leaked NSA exploit and in the WannaCry/NotPetya-era outbreaks, and the flaw has repeatedly been bundled into botnets and ransomware tooling since. Anyone running unpatched Windows Vista SP2 through Windows 10 1607 / Windows Server 2016 with SMBv1 enabled is affected, as are Siemens medical and laboratory devices (ACUSON ultrasound, syngo SC2000, Tissue Preparation System, VERSANT kPCR systems) whose firmware depends on SMBv1. Exploitation is actively ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10) with known ransomware use, carries a 99.2% EPSS exploitation probability (100th percentile), and multiple public exploits and PoCs are available. Do: Apply the Microsoft MS17-010 (March 2017) security updates on every listed Windows version and the corresponding Siemens firmware updates for ACUSON, syngo SC2000, Tissue Preparation System, and VERSANT kPCR devices, per CISA's required action to apply vendor updates. Where patching is not yet possible, disable SMBv1 or block inbound TCP 445 (and UDP 137/138) at network boundaries and isolate legacy/medical systems from the internet. Sweep exposed and legacy hosts for compromise indicators, including DOUBLEPULSAR implants delivered over SMB, as public tooling for detecting and neutralizing this implant is available. | 8.8 | 99% | KEV ransomware PoC ×6 |
| massorder of hundreds of thousands of internet-exposed SMB endpoints, and millions of unpatched Windows systems when internal enterprise and medical-device… |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com | are attempted to connect to an unregistered domain ( hxxp://www[.]iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com ). By registering that domain, he effectively slowed an |
| url | http://www[ | he malware attempted to connect to an unregistered domain ( hxxp://www[.]iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com ). By regi |
Full article755 words · extracted from securityaffairs.com · click to collapse
WannaCry showed how unpatched flaws and leaked cyber tools can cripple global systems, reshaping cybersecurity defenses worldwide.
In memory of the day the digital world was shaken, but learned to fight back.
The WannaCry ransomware attack represents one of the most significant events in recent cybersecurity history, not only for its global scale but also for the technical and geopolitical implications it raised. Analyzing its history means understanding how known vulnerabilities, advanced tools, and delays in mitigation can converge into an event capable of disrupting critical infrastructure worldwide.
WannaCry emerged on May 12, 2017 by exploiting a vulnerability in the SMBv1 protocol of Microsoft Windows (CVE-2017-0144 aka EternalBlue). This vulnerability, which was addressed by the Microsoft security patch MS17-010 in March 2017, allowed remote code execution without authentication. The most critical detail is that the exploit used, known as EternalBlue, was not developed by common cybercriminals but derived from offensive tools attributed to the National Security Agency (NSA), later leaked by the hacker group Shadow Brokers.
This combination made WannaCry particularly effective. It was not a traditional ransomware spread via phishing, but a worm capable of autonomously propagating within networks.
On that day in May, WannaCry began spreading rapidly, infecting over 200,000 systems in more than 150 countries within hours. Among the countries most affected were Spain, United Kingdom, United States, China, Portugal, Vietnam, Russia, and Ukraine, with particular impact on British hospital IT systems and Spanish telecommunications networks.
Italy was also affected by the attack, and the case was handled by the CNAIPIC, the cybercrime operations center of the Polizia Postale. The speed of propagation was largely due to the widespread presence of unpatched systems, especially outdated Windows versions like Windows XP.
Infection mechanism and behavior
Once inside a system, WannaCry encrypted files using strong cryptographic algorithms and displayed a ransom demand in Bitcoin. The requested payment was relatively low, around $300, but increased over time to pressure victims into paying quickly.
From a technical perspective, the real innovation was its automated lateral movement. Using EternalBlue, the malware scanned networks for other vulnerable systems and replicated itself without human interaction. This behavior made it more similar to a classic worm than to traditional ransomware.
A crucial moment in WannaCry’s history was the accidental discovery of a “kill switch.” Security researcher Marcus Hutchins (aka MalwareTech), while analyzing the code, noticed that the malware attempted to connect to an unregistered domain (hxxp://www[.]iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com).
By registering that domain, he effectively slowed and partially stopped the worm’s global spread. This mechanism was likely intended as an anti-analysis technique, but it ended up playing a key role in mitigating the attack.
Attribution and lessons learned
Subsequent investigations attributed the attack to groups linked to North Korea, particularly the Lazarus Group. This attribution, supported by several governments including the United States and the United Kingdom, highlighted how cyber warfare tools can be repurposed in criminal or hybrid operations.
The WannaCry case also sparked intense debate about how governments manage software vulnerabilities. The fact that an intelligence-grade exploit escaped control and was used globally exposed the risks associated with stockpiling cyber weapons.
WannaCry marked a turning point in how cyber risk is perceived. It demonstrated that failing to apply security patches can lead to systemic consequences. Microsoft had released the necessary security update months before the attack, yet many organizations had not implemented it.
Another key lesson concerns network segmentation. The worm’s ability to move laterally exposed weaknesses in internal infrastructures that lacked proper isolation controls.
Finally, WannaCry emphasized the importance of international cooperation in cyber incident response. The timely sharing of technical information helped limit the damage and enabled faster development of countermeasures.
Years later, WannaCry remains a landmark case showing how known vulnerabilities, advanced tools, and organizational shortcomings can combine into a devastating cyberattack. It was neither the most sophisticated nor the most profitable ransomware, but it was undoubtedly one of the most impactful.
Its legacy is still visible today in modern security practices, which place greater emphasis on patch management, network resilience, and preparedness for large-scale attacks.
About the author: Salvatore Lombardo (X @Slvlombardo)
Electronics engineer and Clusit member, for some time now, espousing the principle of conscious education, he has been writing for several online magazine on information security. He is also the author of the book “La Gestione della Cyber Security nella Pubblica Amministrazione”. “Education improves awareness” is his slogan.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, ransomware)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/192015/malware/wannacry-the-ransomware-attack-that-changed-the-history-of-cybersecurity.html