WannaCry Ransomware: How It Works, Who Was Behind It, and Whether It Is Still a Threat

The WannaCry ransomware is a cryptoworm, a type of malware that encrypts files and spreads across networks without user action. Beginning on May 12, 2017, it encrypted Windows computers in more than 150 countries, affecting an estimated 200,000 machines. It spread using EternalBlue, a stolen exploit targeting Microsoft’s file-sharing protocol, and demanded $300 in Bitcoin.

The WannaCry ransomware is among the most frequently cited incidents in the history of computer security, and it is also among the most frequently misdescribed. WannaCry was not a phishing attack, was not novel in its propagation, and did not earn its operators anything close to the sums attributed to it.

For the wider threat category, the ultimate guide to ransomware covers how ransomware works, how it is delivered, and how organizations defend against it.

WannaCry Ransomware: Quick Facts

KEY TAKEAWAY

WannaCry ransomware collected approximately $143,000 worldwide during its operation, while NHS England alone incurred an estimated £92 million in costs from the same attack.

What Is WannaCry Ransomware?

WannaCry ransomware combines two capabilities in a single package: a file encryptor that renders data unusable and a network worm that automatically propagates the encryptor to other machines. Microsoft’s analysis dated May 12, 2017, describes it as spreading “like a worm by leveraging vulnerabilities” and catalogs it as Ransom:Win32/WannaCrypt.

The same malware circulates under several names. Microsoft lists the aliases as “WannaCrypt (also known as WannaCry, WanaCrypt0r, WCrypt, or WCRY),” the name Wanna Decryptor derives from @WanaDecryptor@.exe, and the US Department of Justice later named the May 2017 build “the 2017 WannaCry 2.0 ransomware.”

Symantec recorded that “earlier variants of WannaCry did not have the ability to spread via SMB,” so the version responsible for the outbreak was the first to pair the encryptor with automated network propagation.

WannaCry was built for indiscriminate international. Microsoft recorded the ransom message localized into 28 language versions, and the malware scanned local subnets and internet address ranges automatically, so any reachable, unpatched machine was a candidate.

Is WannaCry a Virus or a Worm? Why the Distinction Matters

WannaCry is a worm, not a virus. NIST defines a worm as “a self-replicating program that propagates itself through a network onto other computer systems without requiring a host program or any user intervention to replicate.” The same glossary defines a virus as “a program that replicates itself by attaching to other programs or files.” WannaCry met the first definition.

The distinction determines which controls apply. Defenses that depend on user behavior act at the moment a person makes a decision. A worm removes that moment entirely: a machine that was powered on, unpatched, and reachable on TCP port 445 was encrypted whether or not anyone was sitting at it.

The more precise labels are cryptoworm and ransomworm, both of which describe self-propagating malware whose payload is file encryption. WannaCry also belongs to the crypto-ransomware category, which encrypts data. That category sits alongside the other types of ransomware that use different delivery routes to reach the same outcome.

The WannaCry 2017 Attack Timeline: 59 Days From Patch to Global Outbreak

The WannaCry 2017 attack timeline shows a 59-day interval between the release of the patch that would have prevented the outbreak and the outbreak itself. No zero-day was involved and no novel technique was required. Every organization that was encrypted on May 12, 2017 had been able to apply the fix since March 14, 2017.

How WannaCry Ransomware Worked: Initial Access, Spread, Encryption, and Extortion

WannaCry ransomware operated in four stages, and each one maps to a different control:

• Initial access came through an unpatched network service
• Propagation occurred automatically across every reachable machine
• Encryption ran locally against a fixed list of file types
• Extortion offered no channel through which a victim could negotiate.

Reading the attack as a single event obscures the fact that four separate defenses each had an opportunity to interrupt it.

WannaCry Initial Access: The EternalBlue Exploit and the SMBv1 Vulnerability (CVE-2017-0144)

The WannaCry initial access vector was a network service. Kaspersky examined the attack and stated on May 15, 2017, that “to date, we could not find an e-mail attack vector for Wannacry.” No phishing email, malicious attachment, exposed remote desktop service, stolen credential or supply chain compromise was ever documented as the route in.

EternalBlue targets a flaw in Microsoft’s Server Message Block version 1 (SMBv1), the protocol Windows uses for file and printer sharing, enabling remote code execution without credentials or user action. CISA’s alert of May 12, 2017 describes the behavior directly: “If a connection to port 445 is successful, it creates an additional thread to propagate by exploiting the SMBv1 vulnerability.” The flaw is cataloged as CVE-2017-0144, one of six addressed by MS17-010.

User behavior was therefore not a variable in this attack. An employee who never opened an email that Friday was encrypted on the same terms as anyone else, provided the machine was powered on, unpatched and reachable on TCP port 445.

How Did WannaCry Spread So Quickly? DoublePulsar, Port 445 Scanning, and Worm Propagation Without User Interaction

WannaCry spread so quickly because every infected machine immediately became a scanner for the next one, with no human step in between. Microsoft’s analysis records that “the worm functionality attempts to infect unpatched Windows machines in the local network” while it “also executes massive scanning on Internet IP addresses.” A single infected laptop carried into an office could reach every unpatched machine on that network within minutes.

The dropper delivered the EternalBlue exploit against an exposed SMBv1 service. Microsoft records that on a successful infection “the malware runs kernel-level shellcode that seems to have been copied from the public backdoor known as DOUBLEPULSAR,” which then handled payload deployment. The encryptor and the propagation component traveled together, so every new host became both victim and distributor.

Local subnet sweeps caused the concentrated damage inside organizations, while random internet IP scanning produced the geographic spread across more than 150 countries. A flat network, one in which any machine can reach any other on the same ports without inspection, converts a single infection into an organization-wide blast radius.

How Did WannaCry Encryption Work? RSA-2048, the .WNCRY File Extension and Why There Was Never a Universal Decryptor

WannaCry encryption worked by generating a 2048-bit RSA key pair on each infected machine and encrypting files locally, so no two victims shared a key. Encrypted files were renamed with the “.WNCRY” extension, and Microsoft records a fixed target list covering documents, spreadsheets, databases, archives, images and media.

The malware did not treat every file the same way, which is why some victims recovered more than others. Kaspersky’s analysis of June 1, 2017 records that read-only files were not encrypted at all. Files outside the folders the operators treated as important were “simply deleted from the disk, which means there is a high chance it will be possible to restore them using data recovery software.”

WannaCry also removed the local recovery options a victim would reach for first. Microsoft documents that the malware deletes volume shadow copies, clears the backup catalog, and disables Windows startup recovery.

No universal WannaCry decryptor was ever possible, because the private key was generated on the victim machine and then protected by a key held only by the operators.

WannaKey and wanakiwi recover keys from prime numbers left in the memory of the still-running ransomware process. Those tools work only on 32-bit Windows XP, 2003, Vista, 7 and Server 2008, and only if the machine has not been rebooted. No More Ransom lists no WannaCry decryptor, leaving a backup that was unreachable from the infected host as the only dependable path.

What Was the WannaCry Ransom? A $300 Bitcoin Demand With No Leak Site and No Negotiation

The WannaCry ransom was $300 in Bitcoin per machine, doubling to $600 after three days, and its mechanism was primitive even by the standards of 2017. Payment was requested through the @Please_Read_Me@.txt note and the ransom screen, with no victim portal, no negotiation channel and no affiliate structure of the kind that defines ransomware-as-a-service.

The screen also carried a deletion threat the code did not support. Kaspersky recorded the warning that “if you don’t pay in 7 days, you won’t be able to recover your files forever.” Symantec reported that it “has not found any code within the ransomware which would cause files to be deleted.”

WannaCry was also single extortion. It encrypted data but did not exfiltrate it, and no leak site was ever operated. The Tor components it bundled for command-and-control communication served the operators, and it did not give a victim any means of contact.

The payment mechanism also contained a flaw that made the transaction unworkable. Symantec reports that the ransomware “defaults to three hardcoded Bitcoin addresses for payment” and that “due to a race condition bug this code does not execute correctly.” That left the operators with no reliable way to match a payment to the machine that sent it. Paying therefore assumed a counterparty that could deliver decryption, and there was not one.

How Was the WannaCry 2017 Attack Stopped?

The WannaCry 2017 attack was halted, or more precisely slowed, when a researcher registered a domain name that the malware checked before it encrypted anything. Marcus Hutchins, working under the name MalwareTech, examined a sample on May 12, 2017. He wrote the following day: “Upon running the sample in my analysis environment I instantly noticed it queried an unregistered domain, which i promptly registered”.

The check was never built as an off switch. Hutchins concluded it was “a badly thought out anti-analysis” measure meant to detect the artificial environments researchers use to study malware, which often answer every network request automatically. Registering the domain made that check succeed everywhere at once, so every infected machine able to reach it concluded it was under observation and exited before encrypting.

Hutchins was arrested in the United States in August 2017 on unrelated charges concerning the Kronos banking trojan, pleaded guilty on May 2, 2019, and was sentenced on July 26, 2019, to supervised release with no prison time.

Why the WannaCry Kill Switch Did Not Save Enterprise Networks

The WannaCry kill switch only fired if the infected machine could reach the sinkhole domain directly, which most corporate machines could not. The UK National Cyber Security Centre stated the constraint plainly on May 19, 2017: “the malware is not proxy aware so a local DNS record may be required.” Organizations routing outbound traffic through an HTTP proxy, which describes most enterprise networks, never delivered the abort signal to their endpoints.

Organizations running a proxied corporate network on May 12, 2017 received no protection from the WannaCry kill switch. That constraint separates the home users and small offices where the abort fired from the hospital trusts, manufacturers, and telecom operators where it did not.

Hutchins recorded the limitation himself, noting that “our sinkholing only stops this sample and there is nothing stopping them removing the domain check and trying again.” Variants followed within days. The original sample self-neutralizes only for as long as something answers at the sinkhole address, which Kryptos Logic has kept operating since 2017.

Who Was Behind WannaCry?

No one has been tried or convicted for the WannaCry attack. The attribution rests on government assessments and an untested criminal complaint. Within those limits, six governments agree: the WannaCry ransomware campaign is attributed to the Lazarus Group, a threat actor associated with North Korea.

The exploit did not originate with its operators. EternalBlue was released publicly by a group calling itself the Shadow Brokers on April 14, 2017. Brad Smith, writing for Microsoft on May 14, 2017, stated that “the WannaCrypt exploits used in the attack were drawn from the exploits stolen from the National Security Agency, or NSA, in the United States.”

The United States announced its attribution on December 19, 2017. Thomas Bossert, then Assistant to the President for Homeland Security and Counterterrorism, said at a White House press briefing that “after careful investigation, the United States is publicly attributing the massive WannaCry cyberattack to North Korea.” He confirmed that the United Kingdom, Australia, Canada, New Zealand and Japan joined the denunciation.

The United Kingdom used calibrated language the same day. The Foreign and Commonwealth Office stated that “the UK’s National Cyber Security Centre assesses it is highly likely that North Korean actors known as the Lazarus Group were behind the WannaCry ransomware campaign.” The phrase “highly likely” is a probability judgment.

On September 6, 2018, the US Department of Justice charged Park Jin Hyok, a North Korean citizen it described as a member of the Lazarus Group, over the 2017 WannaCry 2.0 ransomware, the 2016 Bangladesh Bank theft and the 2014 Sony Pictures attack. The department stated that “the charges contained in the criminal complaint are merely accusations.” Park Jin Hyok has not stood trial.

Symantec found tools used exclusively by Lazarus on machines infected with earlier versions of WannaCry, yet concluded that “these findings do not indicate a definitive link between Lazarus and WannaCry.”

How Much Damage Did WannaCry Ransomware Cause?

WannaCry ransomware caused damage out of all proportion to what it earned. The operators drained approximately 52.2 BTC, worth roughly $143,000, on August 2 and 3, 2017, while NHS England alone absorbed an estimated £92 million from the same attack.

CBS News reported on May 16, 2017 that the $4 billion estimate came from Cyence, a cyber risk modeling company, four days into the incident, and noted that “other groups predict losses would be in the hundreds of millions.” No methodology was published with it, which makes it a projection of potential cost.

The NHS: The Most Rigorously Costed Victim of the Attack

NHS England is the only WannaCry victim whose costs were examined by both a national audit body and a government department. The UK Department of Health and Social Care put the total at £92 million in its October 2018 update: £19 million in lost output and £0.5 million for IT support during the attack, plus £72 million for IT recovery afterward.

Roughly 78% of that total was spent after the incident ended, which runs counter to the assumption that the expensive part of a ransomware attack is the downtime. The Department attached its own caveat, that “it is not possible to estimate with certainty the financial impact of the WannaCry attack.”

The operational cost was recorded more precisely than the financial one. The NHS England lessons-learned review of February 1, 2018 records that “80 out of 236 trusts across England were affected,” alongside “595 out of 7,454 GP practices (8%).”

Two appointment figures circulate, and they are not the same measurement: the UK National Audit Office reported that “NHS England identified 6,912 appointments had been cancelled, and estimated over 19,000 appointments would have been cancelled in total.” That makes 6,912 a count and 19,000 an extrapolation. The same office recorded that “no NHS organisation paid the ransom,” so the entire £92 million was incurred without a single pound reaching the ransomware operators.

What Data Was Compromised and Did Anyone Who Paid Get Their Files Back?

No data was confirmed to have been stolen in the WannaCry attack. The ransomware encrypted files, did not exfiltrate, and no leak site was ever operated. The NHS stated during the incident that “at this stage, we do not have any evidence that patient data has been accessed”.

Whether anyone who paid the WannaCry ransom recovered their files was never established because the three hardcoded Bitcoin wallets contained no per-victim identifier, and the operators could not tell which machine a payment came from. NBC News reported that “$57,282.23 in ransom had been paid” across roughly 190 payments by the Monday evening following the outbreak.

Other WannaCry Victims by Sector: Renault, Telefónica and the Wider Blast Radius

WannaCry did not target anyone. It scanned for exposed port 445 and encrypted whatever it found. That indiscriminate behavior explains why a hospital trust, a car plant, a telecom operator and a railway all appear within the same 48-hour window with nothing connecting them.

The aftershock illustrates that remediation did not hold. One widely repeated attribution also belongs elsewhere: FedEx is often listed among WannaCry’s costliest victims, but the quantified damage to its TNT Express subsidiary was caused by NotPetya five weeks later. FedEx’s own Form 10-K attributes it to “an information technology virus known as Petya.”

WannaCry Ransomware Prevention: What Lessons Were and Were Not Learned From the 2017 Attack?

The initial access route WannaCry used has become the most common one in the industry. Verizon’s 2026 Data Breach Investigations Report states that “the exploitation of vulnerabilities is the most prominent initial access vector in our dataset this year, reaching the height of 31%, up from 20% last year.”

Mandiant’s M-Trends 2026 reports that “exploits remained the most common initial infection vector for the sixth consecutive year, accounting for 32% of intrusions.”

Remediation moved in the wrong direction over the same period. The same Verizon report found that “only 26% of the CISA KEV vulnerabilities had been fully remediated, a considerable drop from last year’s 38%.” The same report added that “our new median time is 43 days, almost two weeks longer than last year’s 32 days.”

WannaCry ransomware exploited a vulnerability patched 59 days earlier, so the exposure window that made it possible has widened. Establishing where that window sits in a given estate is the purpose of a ransomware risk assessment.

Beyond “Just Patch”: What Security Teams Can Do to Prevent WannaCry and Similar Ransomware

The NHS England lessons-learned review found that “none of the 80 NHS organisations affected by WannaCry had applied the Microsoft update patch.” NHS Digital’s CareCERT bulletin had advised applying it on April 25, 2017, seventeen days before the outbreak.

That finding is usually read as negligence, and the more useful reading is that patching was not straightforward in these estates. The House of Commons Public Accounts Committee recorded the structural reason in April 2018: “medical devices provided by external suppliers need to be updated by that supplier, not by the trust.”

The same committee noted that “NHS Digital told us it has developed guidance for trusts about isolating medical devices from their network,” which is the compensating control when the patch is not available to the operator. The controls below address the stages WannaCry passed through, and the wider set is covered in this guide to preventing ransomware.

How to Detect WannaCry Ransomware and What to Do if a Machine Is Already Infected

WannaCry detection rests on network behavior because the worm is visible before encryption completes. As with broader ransomware detection, the signals worth alerting on are:

• A single host opening SMB sessions to an unusual number of internal peers in a short window;
• SMB traffic crossing segment boundaries with no business reason to carry it;
• SMBv1 negotiation attempts where the protocol is supposed to be disabled.

The UK National Cyber Security Centre guidance and CISA alert TA17-132A carry the technical detail.

The ransomware incident response sequence contains one decision that has to be made before the machine is touched. Isolating an infected host from the network is the safe default, because it stops the worm reaching other machines and forecloses nothing.

Powering that machine down carries a hidden cost, because wanakiwi warns that “if this process had been killed by, for instance, a reboot - the original process memory will be lost.” A shutdown therefore destroys the only chance of key recovery on the legacy systems where those tools work at all.

The safe order is therefore isolation first and power decisions second. On modern 64-bit Windows the memory-based recovery tools do not work in any case, so a restart costs nothing there and containment is the only live consideration. Only on legacy 32-bit hosts does leaving the machine powered on, and disconnected, preserve an option that a reboot removes permanently.

Is WannaCry Ransomware Still a Threat Today?

Whether WannaCry ransomware is still a threat depends on which question is being asked. As an active campaign, it ended in 2017. As malware still circulating, WannaCry ransomware remains among the most frequently encountered ransomware families in the world. Kaspersky’s telemetry for the second quarter of 2026 ranks it second at 7.14% of all users attacked by ransomware.

That percentage counts detections of attempted attacks, which makes the “most-detected ransomware” framing misleading.

The reason detections persist is the sinkhole. Machines still running unpatched SMBv1 are reached by copies of the original worm that perform the domain check, receive a response, and exit before encrypting anything. WannaCry is therefore detected constantly and succeeds rarely, on a protocol Microsoft deprecated in 2014.

The exploit outlived the malware that made it famous. CISA’s alert of July 1, 2017 on the NotPetya outbreak records that it used “EternalBlue - the same Windows SMBv1 exploit used by WannaCry.” CISA added CVE-2017-0144 to its Known Exploited Vulnerabilities catalog on February 10, 2022, with a remediation deadline of August 10, 2022.

Five years after the outbreak, US federal agencies had to be formally ordered to apply a patch Microsoft had shipped in March 2017.

The closest current parallel is Windows 10. Microsoft ended support on October 14, 2025, and Extended Security Updates run to October 12, 2027 for consumers at a one-time $30, or three years for commercial customers at $61, $122 and $244 per device.

Microsoft ended extended support for Windows XP in April 2014. Three years later, WannaCry encrypted an NHS estate in which “5% of the NHS IT estate was still using Windows XP”.

Unsupported estates do not fail on the end-of-support date. They fail a refresh cycle later. That is the sense in which WannaCry ransomware remains a threat in 2026: the conditions that allow it to operate.

What the WannaCry Ransomware Attack Teaches Security Teams

WannaCry ransomware was not an unprecedented attack, and treating it as one obscures what it actually demonstrated. The patch had existed for 59 days, the exploit came from a public dump, the technique belonged to a generation of worms from the early 2000s. The operators collected roughly $143,000 while NHS England alone spent an estimated £92 million. The failure came from exposure and flat internal networks inside the defending organizations.

The route in has since moved. WannaCry required no person to make a mistake, whereas the vectors that replaced it largely do. Mandiant’s M-Trends 2026 records that email phishing “dropped to just 6% of intrusions in 2025” while “highly interactive voice phishing saw a significant surge to 11%, becoming the second-most commonly observed vector.”

Adaptive Security addresses the phishing problem, defending organizations against AI-generated phishing, voice scams and deepfake social engineering. The platform can be explored through a self-guided tour. The exposure, segmentation and recovery failures that WannaCry ransomware revealed remain a separate discipline.

WannaCry Ransomware FAQ

Who Stopped WannaCry?

Marcus Hutchins, a researcher publishing as MalwareTech, halted the original WannaCry ransomware sample on May 12, 2017, by registering a domain the malware queried before encrypting. The check was a sandbox evasion logic. It did not protect enterprise networks, because machines behind an outbound HTTP proxy never reached the domain and kept encrypting.

Who Created WannaCry?

WannaCry is attributed to the Lazarus Group, a threat actor associated with North Korea, by the United States, United Kingdom, Australia, Canada, New Zealand and Japan on December 19, 2017. The US Department of Justice charged Park Jin Hyok on September 6, 2018. No trial or conviction has followed, so the attribution rests on government assessment.

How Many Computers Did WannaCry Infect?

Estimates range from roughly 45,000 to more than 200,000 machines, depending on the source and the date. Kaspersky recorded more than 45,000 attacks in 74 countries on May 12, 2017 alone. Europol’s then-director put the figure at more than 200,000 victims in at least 150 countries two days later. The widely quoted 300,000 has no traceable primary measurement.

Does WannaCry Affect Mac or Linux?

No. WannaCry runs only on Microsoft Windows and spreads by exploiting CVE-2017-0144, a flaw that the National Vulnerability Database lists exclusively in Windows implementations of SMBv1 servers. macOS and Linux machines cannot be encrypted directly by it, though either can host files on a Windows share that an infected Windows host then encrypts.

Can WannaCry-Encrypted Files Be Decrypted?

Only in narrow circumstances. WannaKey and wanakiwi can rebuild the private key from prime numbers left in the memory of the running ransomware process. Those tools work only on 32-bit Windows XP, 2003, Vista, 7, and Server 2008, and only if the machine has not been rebooted. No universal WannaCry decryptor exists, and No More Ransom lists none.