WannaCry

Description

WannaCry is a ransomware worm that spread globally in May 2017 by exploiting the EternalBlue vulnerability in Windows file sharing, infecting hundreds of thousands of machines across more than 150 countries within days. The outbreak devastated hospitals, railways, and businesses, and a kill switch domain slowed its spread while organizations patched. Governments attributed the attack to North Korean actors, and the incident remains the defining case study in the cost of unpatched systems.

Stats

First seen: January 2022
Last seen: October 2026

Also known as

WanaCryWannaCryptorWannacry

MITRE ATT&CK techniques

16 techniques across 8 tactics.

TA0002 Execution

T1047Windows Management Instrumentation

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service

TA0005 Stealth

T1564Hide Artifacts
- T1564.001Hidden Files and Directories

TA0007 Discovery

T1016System Network Configuration Discovery
T1018Remote System Discovery
T1083File and Directory Discovery
T1120Peripheral Device Discovery

TA0008 Lateral Movement

T1210Exploitation of Remote Services
T1563Remote Service Session Hijacking
- T1563.002RDP Hijacking
T1570Lateral Tool Transfer

TA0011 Command and Control

T1090Proxy
- T1090.003Multi-hop Proxy
T1573Encrypted Channel
- T1573.002Asymmetric Cryptography

TA0040 Impact

T1486Data Encrypted for Impact
T1489Service Stop
T1490Inhibit System Recovery

TA0112 Defense Impairment

T1222File and Directory Permissions Modification
- T1222.001Windows Permissions

Associated groups

G0032Lazarus Group

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Ransomware.WannaCry	ATP Sandbox Adv. Heuristics
Dump:Generic.Ransom.WannaCryptor.C2312CA0	AV
Gen:Variant.Ransom.Wannacry.125	AV
Gen:Variant.Ransom.Wannacry.126	AV
Gen:Variant.Ransom.WannaCry.24	AV
Gen:Variant.Ransom.WannaCryptor.30	AV
Generic.Ransom.WannaCryptor.292E472B	AV
Generic.Ransom.WannaCryptor.92BB81C8	AV
Generic.Ransom.WannaCryptor.C40D3F15	AV
Generic.Ransom.WannaCryptor.CB9EE00D	AV
Generic.Ransom.WannaCryptor.FA7C2316	AV
Script-Python.Ransomware.WannaCry	ATP Sandbox Adv. Heuristics
Trojan.Ransom.WannaCry.1	AV
Trojan.Ransom.WannaCry.H	AV
Trojan.Ransom.WannaCryptor.A	AV
Trojan.Ransom.WannaCryptor.D	AV
Trojan.Ransom.WannaCryptor.G	AV
Trojan.Ransom.WannaCryptor.H	AV
Trojan.Ransom.WannaCryptor.K	AV
Trojan.Ransom.WannaCryptor.L	AV
Trojan.Ransom.WannaCryptor.P	AV
Trojan.Ransom.WannaCryptor.U	AV
Win32.Ransomware.WannaCry	ATP Sandbox Adv. Heuristics
Win32.Trojan.WanaCry	ATP Sandbox Adv. Heuristics
Win64.Ransomware.WannaCry	ATP Sandbox Adv. Heuristics