WannaCry: The Ransomware That Moved at the Speed of a Worm

How a leaked government exploit and a two-month-old patch collided into the fastest ransomware attack on record.

An Adaptive Security series on the ransomware attacks that shaped modern cyber defense. Hub: A History of Notable Ransomware Attacks. Previously: Cryptorbit.

Two months before WannaCry became the fastest spreading ransomware attack in history, Microsoft had already published the fix for it. That fact says more about how WannaCry spread than any line of its code. On May 12, 2017, a Friday, the worm reached more than 150 countries and roughly 200,000 computers in a single day, hitting a security hole that a patch had already closed for anyone who installed it. Hospitals stopped admitting patients. Factories stopped their assembly lines. Train boards in Germany displayed the ransom note instead of departure times. All within hours, and all from a single piece of code moving on its own.

That security hole came from a tool called EternalBlue, built by the National Security Agency to exploit a flaw in how Windows computers share files over a network. A group calling itself the Shadow Brokers leaked EternalBlue online in April 2017, one month before WannaCry appeared. Microsoft had already patched the flaw in the supported, updated versions of Windows.

What made WannaCry different from GPcode, Cryptorbit, or CryptoLocker was how it spread. Earlier ransomware needed a person to open an email attachment or click a fake update. WannaCry needed only one infected machine on a network. It then spreads on its own to every other vulnerable machine on that network, no click required. That is what a worm does, and it is why the damage showed up in hours instead of weeks.

A Bad Friday Across Five Continents

Hospitals across the United Kingdom’s National Health Service canceled surgeries and diverted patients. Renault halted production at plants in France. FedEx reported being hit the same day, along with telecom and rail systems in Spain, Germany, and Russia. Estimates of the total number of affected organizations that week ran past 100,000.

Avi Rubin, professor of computer science at Johns Hopkins University and technical director of its Information Security Institute, pointed to why hospitals were hit especially hard. “A lot of health care systems are running older versions of Windows that are no longer supported by Microsoft, such as XP,” he said. His advice on response has become close to a standard line in the industry. “Having backups of your data is the best response to the ransomware threat, because if you have data backed up, there is no need to pay someone ransom,” Rubin said.

Matthew Green, a cryptographer at Johns Hopkins University, put the fix in the plainest terms he could. “[People] need to install patches. For most people, that means run Windows Update,” he said. He also pointed to where the vulnerability had come from in the first place. “Microsoft is certainly right to be upset that a series of very sophisticated hacking tools were developed at the National Security Agency, and then subsequently lost,” Green said.

An Accidental Off Switch

WannaCry’s spread slowed down almost by accident. The malware checked whether a specific, unregistered web address would respond before it kept encrypting files. Security researchers call this a sandbox check, a common way malware tests whether it is running inside a researcher’s monitored environment instead of on an ordinary victim’s machine.

Marcus Hutchins, a security researcher, was in the habit of registering unusual web domains he found while studying malware, in case they turned out to be useful later. “Whenever I see another registered domain, I just grab it because it could be useful later," he said. "It might not give us control, it might just be statistics, but either way there may be value.”

What he did not know until his team studied WannaCry’s code was that the malware checked that exact domain before encrypting any files. If the domain responded, WannaCry assumed it was running inside a security researcher's test environment and shut itself down. If nothing responded, it assumed it had reached an ordinary victim’s computer and started encrypting. The moment Hutchins registered the domain, every future infection got a response and shut down instead of spreading, turning his routine habit into the reason the worm stopped. Kevin Mandia, the incident responder who went on to lead FireEye, called the check the clumsiest way to avoid running inside a virtual machine he had ever seen.Microsoft’s response went further than a routine patch cycle. Days after the attack, it released updates for Windows XP and other systems it had already stopped supporting, a step the company reserves for emergencies. Brad Smith, Microsoft’s president and chief legal officer, used the moment to criticize how the exploit became public in the first place. “Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage,” he wrote, comparing it to “the U.S. military having some of its Tomahawk missiles stolen.”

The United States and United Kingdom later attributed WannaCry to North Korea’s Lazarus Group, the group also linked to the 2014 Sony Pictures hack. It stands apart from most of this history as an attack tied to a nation-state rather than a criminal gang.

The Lesson Wasn’t About Ransomware

WannaCry’s power came from one unpatched machine finding another, spreading to hundreds of thousands of them in a single day. No clever ransom note or new encryption scheme was required. The lesson organizations carried forward was simpler: a known, fixable security hole can do enormous damage once it reaches a large enough network, whether or not ransomware ever gets involved. Closing that gap is a human problem as much as a technical one. Someone has to notice the update is overdue, escalate it, and act before an attacker finds it first. Adaptive Security studies this history because that kind of organizational discipline decided who spent May 12, 2017 recovering from an attack, and who never noticed anything happened.

Next in this series: GandCrab, the strain that turned ransomware into a subscription business.