WannaCry

WannaCry is a Ransomware Worm that targeted Windows operating systems, Exploiting a Vulnerability in the SMB (Server Message Block) protocol to spread rapidly across networks. Once a system is infected, WannaCry encrypts files and demands a Bitcoin ransom for their decryption, causing widespread disruption and financial losses.

WannaCry combines Ransomware with Worm-like capabilities, allowing it to replicate itself and infect additional devices without user intervention. It uses the EternalBlue Exploit, a Vulnerability in Windows SMB that was allegedly developed by the NSA and later leaked publicly. WannaCry's rapid spread and aggressive Encryption tactics led to significant disruptions, particularly in healthcare and government sectors.

The purpose of WannaCry is to extort money from victims by encrypting critical files and demanding payment for their release. By spreading autonomously, WannaCry aimed to infect as many systems as possible, leveraging outdated or unPatched systems to gain access and propagate across networks.

WannaCry was executed by Exploiting the EternalBlue Vulnerability, which allowed it to access systems with open SMB ports. Once inside a network, WannaCry spread quickly, encrypting files with the '.WNCRY' extension and displaying a ransom note demanding payment in Bitcoin. Users were urged to install security Patches, particularly the Microsoft Patch MS17-010, to protect against WannaCry.

WannaCry affected numerous organisations worldwide, including the UK’s National Health Service (NHS), which faced significant disruptions to healthcare services. Other impacted sectors included transportation, telecommunications, and manufacturing, with widespread data loss and financial impacts.

WannaCry highlighted the risks of unPatched systems and inadequate cybersecurity practices. Organisations can protect against similar attacks by implementing regular Patch management, disabling vulnerable services (like SMBv1), and using updated anti-Malware software. WannaCry also emphasised the importance of secure backups and user awareness in preventing Ransomware infections.