WannaCry Ransomware
- Date (as written)
- 2017-05
- Year
- 2017
- Country
- ZZZ, 🇷🇺 Russian Federation, 🇯🇵 Japan, 🇬🇧 United Kingdom, 🇫🇷 France, 🇰🇷 Korea, Republic of, 🇮🇳 India, 🇨🇳 China, 🇩🇪 Germany, 🇪🇸 Spain, 🇮🇩 Indonesia, 🇧🇷 Brazil, 🇺🇸 United States
- Actors (as written)
- Lazarus
- Actor pages
- Lazarus
- Tags (as written)
- FinancialGain
- Dollar figures (as written)
- $300; $600; US$100 million; $150,000; 144,000 USD; $112 million; $140,000; $68K
Source entries (102)
WannaCry Ransomware · 2017-05
The WannaCry ransomware attack (May 2017) was a global cryptoworm outbreak that exploited the leaked NSA-developed EternalBlue vulnerability in Microsoft Windows SMBv1, enabling it to self-propagate automatically across networks without user interaction; once infected, systems had their files encrypted and were held for ransom ($300–$600 in Bitcoin), rapidly spreading to over 200,000–230,000 systems in more than 150 countries within days, severely disrupting critical sectors such as healthcare (e.g., hospitals), transportation, and telecommunications, with estimated damages reaching hundreds of millions to billions of dollars; although Microsoft had released a patch prior to the attack, widespread failure to update systems allowed mass exploitation, and while a discovered “kill switch” eventually slowed the spread, the incident became a landmark example of wormable ransomware leveraging leaked state-developed exploits, highlighting the catastrophic impact of unpatched vulnerabilities and marking a turning point in global cybersecurity awareness.
North Korean State-Sponsored Hacking Group Lazarus Launched WannaCry Ransomware Attack Infecting Over 200,000 Computers in 150 Countries, Including Major Corporations and the UK National Health Service in May 2017 · 01.05.2017
The WannaCry ransomware attack that broke out in May 2017 ranks as a major global ransomware incident. The attack affected over 200,000 computers in 150 countries and impacted companies such as FedEx, Honda, Nissan, and the UK National Health Service. WannaCry is a ransomware that targets Windows operating systems that have not been patched with a specific update offered by Microsoft since March 2017 and encrypts certain user files on the computer. Utilizing the EternalBlue exploit, the ransomware was able to spread rapidly by infecting other vulnerable systems on the same network. The ransomware initially set a ransom of 300 USD (in Bitcoin) and was later increased to 600 USD. Some victims only had a few days to respond to the ransomware demand - otherwise, they risked losing their data. The security authorities subsequently attributed the attack to the Lazarus Group, which is linked to North Korea, although some researchers dispute this attribution. The spread of the attack was inadvertently stopped when a security researcher registered a domain found in the malware's code. Once inside a system, WannaCry employed asymmetric encryption, using a combination of RSA and AES encryption algorithms to lock files, which made the decryption key unique and almost impossible to reproduce without paying the ransom. In 2018, the US brought charges against a North Korean agent of APT Lazarus, who was also previously blamed for the Sony hack in 2014. The extensive damage caused by WannaCry, with an estimated global cost in the billions, was particularly severe for organizations like the UK’s National Health Service (NHS), which suffered an estimated loss of US$100 million due to a large number of vulnerable machines. The discovery of a "kill switch" within the WannaCry code eventually stopped the 2017 outbreak from spreading further, although modified versions of the ransomware have since surfaced but failed to reach the same scale or notoriety as the original. On July 30 2020, the Council of the European Union santioned, within the framework of the EU Cyber Diplomacy Tollbox, the North Korean company Chosun Expo for the WannaCry attack
Sources cited by EuRepoC (65)
Show 60 more
WannaCry ransomware · 2017-05
WannaCry ransomware
ThaiCERT's whitepaper:
https://www.dropbox.com/s/hpr9fas9xbzo2uz/Whitepaper WannaCry Ransomware.pdf?dl=0
WannaCry- US Critical Infrastructure · 5/12/2017
Finance the regime.
WannaCry- IK NHS · 5/12/2017
Finance the regime.
Vivo · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
University of Montreal · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
University of Milano-Bicocca · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Universitas Jember · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
TSMC · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
TimrÃÆÃ'Ãâ 'ÃÆ'Ã'ÃÂ¥ Municipality · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Telkom · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Sun Yat-sen University · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Government of West Bengal · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Government of Maharashtra · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Government of Kerala · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Government of Gujarat · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Shandong University · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Saudi Telecom Company · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Justice Court of Sao Paulo · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Q-Park · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Pulse FM · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
O2 · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
LATAM Airlines Group · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
LAKS · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Lakeridge Health · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Instituto Nacional de Salud · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Honda · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Harapan Kita Hospital · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Guilin University of Electronic Technology · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Guilin University of Aerospace Technology · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Garena Blade and Soul · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Faculty Hospital, Nitra · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Dalian Maritime University · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Cambrian College · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Boeing Commercial Airplanes · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Automobile Dacia · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Aristotle University of Thessaloniki · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Foreign Ministry of Brazil · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Russian Central Bank · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system. The Russian Central Bank detected an attack on its systems, but was able to thwart it.
White Sands · 2017-05-12
Message Manipulation; Data Attack
Tiong Bahru Plaza · 2017-05-12
Message Manipulation; Data Attack
Sandvik · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Bank of China · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Russian Railways · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Telenor Hungary · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Portugal Telecom · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Petrobras · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
West Bengal State Electricity Distribution Company · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Gas Natural · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Iberdola · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Andhra Pradesh state police · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Dharmais Cancer Hospital · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
CJ CGV · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
MegaFon · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Russian Ministry of the Interior · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
VTB · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Sberbank · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Hitachi · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
China National Petroleum Corp · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Nissan · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system. The attack shut down a Nissan factory in Sunderland.
Renault · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system. The attack shut down Renault operations in several countries.
Deutsche Bahn · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Telefonica · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
UK National Health Service · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
FedEx · 2017-05-12
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with theÃÆÃ''ÃÆ'Ã'ÃÂ decryption key only after a ransom had been paid. The threat actors used an exploit, called EternalBlue--first discovered by the U.S. National Security Agency--to propagate WannaCry in organizations using the Windows operating system.
Wannacry · 2017-05-12
Amt Stolen: $150,000
WannaCry · Jun 2017
A threat actor used a tool called WannaCry to encrypt data in compromised networks, and intended to provide the victims with the decryption key only after a ransom had been paid. The threat actors used an exploit, called
WannaCry attack resulted in Bitcoin laundered through Monero 144,000 USD (52 Bitcoin) · 12 May 2017
Annex 21: Suspected DPRK cyber-attacks on financial institutions (including banks and cryptocurrency exchanges) investigated by the Panel. B. Cryptocurrency. WannaCry attack resulted in Bitcoin laundered through Monero 144,000 USD (52 Bitcoin)
WannaCry Ransomware · 2017-05
Reported: 2017-05; Victims: WannaCry Ransomware; Motivations: FinancialGain; Sectors: None; Countries: Worldwide, Russian Federation, Japan, United Kingdom, France, Korea, Republic of, India, China, Germany, Spain, Indonesia, Brazil, United States
WannaCry ransomware attack · May 12, 2017
The WannaCry attack was a massive ransomware cyberattack that hit institutions across the globe ranging all the way from the NHS in Britain, to Boeing, and even to Universities in China on May 12, 2017. The attack lasted 7 hours and 19 minutes. Europol estimates it affected nearly 200,000 computers in 150 countries, primarily affecting Russia, India, Ukraine, and Taiwan.
May 2017 WannaCry ransomware attack · May 2017
May 2017 WannaCry ransomware attack
WannaCry 2.0 · May 2017
WannaCry 2.0. DPRK state-sponsored cyber actors developed the ransomware known as WannaCry 2.0, as well as two prior versions of the ransomware. In May 2017, WannaCry 2.0 ransomware infected hundreds of thousands of computers in hospitals, schools, businesses, and homes in over 150 countries. WannaCry 2.0 ransomware encrypts an infected computer’s data and allows the cyber actors to demand ransom payments in the Bitcoin digital currency. The Department of the Treasury designated one North Korean computer programmer for his part in the WannaCry 2.0 conspiracy, as well as his role in the Sony Pictures cyber attack and Bangladesh Bank heist, and additionally designated the organization he worked for. CISA’s Technical Alert: Indicators Associated with WannaCry Ransomware (May 12, 2017) https://www.us-cert.gov/ncas/alerts/TA17-132A White House Press Briefing on the Attribution of WannaCry Ransomware (Dec. 19, 2017) https://www.whitehouse.gov/briefings-statements/press-briefing-on-the-attribution-of-the-wannacry-malware-attack-to-north-korea-121917/ DOJ’s Criminal Complaint of a North Korean Regime-Backed Programmer (Sept. 6, 2018) https://www.justice.gov/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and Treasury Targets North Korea for Multiple Cyber-Attacks (Sept. 6, 2018) https://home.treasury.gov/news/press-releases/sm473
WannaCry 2.0 · December 2017 (attribution)
Lazarus Group was involved in the destructive WannaCry 2.0 ransomware attack which the United States, Australia, Canada, New Zealand and the United Kingdom publicly attributed to North Korea in December 2017.
WannaCry impact on UK National Health Service
Among the publicly identified victims was the United Kingdom’s (UK) National Health Service (NHS). Approximately one third of the UK’s secondary care hospitals — hospitals that provide intensive care units and other emergency services — and eight percent of general medical practices in the UK were crippled by the ransomware attack, leading to the cancellation of more than 19,000 appointments and ultimately costing the NHS over $112 million, making it the biggest known ransomware outbreak in history.
WannaCry 2.0 · May 2017
In May 2017, a ransomware attack known as WannaCry 2.0 infected hundreds of thousands of computers around the world, causing extensive damage, including significantly impacting the United Kingdom’s National Health Service.
Wannacry Ransomware Attack · May 2017
Exploiting a Windows vulnerability that allowed it to self-propagate, the cryptoworm hit over 200,000 individuals in over 150 countries. The hacker group raised around $140,000 in bitcoin as ransom.
WannaCry ransomware (CSE and partner attribution); UK health service facilities affected · (not dated in quote; WannaCry 2017)
the ransomware spread to 25 facilities in a national health organization that provides emergency services. The incident forced the cancellation of over 19,000 appointments, including surgeries. Endnote 17 The Communications Security Establishment and partner agencies have attributed WannaCry to North Korean cyber threat actors.
WannaCry ransomware campaign (New Zealand joins attribution) · 2017 (called out in 2017/18)
In 2017/18, the GCSB joined international partners in calling out the Russian Government and North Korean cyber actors for indiscriminate cyber-attacks. The NotPetya (Russia) cyber- attack and WannaCry (North Korean actors) ransomware campaign caused substantial harm and disruption to computer systems around the world in 2017. This was the first time a New Zealand Government agency has attributed hostile cyber activity to a foreign power.
WanaCrypt0r Ransomworm · 16 May 2017 (blog post date, 2017-05-16)
This backdoor family is a tool from the Lazarus threat actors. [...] The linkages to the Lazarus campaign are tantalising clues as to who may be ultimately behind this. [...] Even though $68K may represent a modest profit for the attackers
WannaCry ransomware (WannaCry 2.0) global attack, including UK National Health Service · May 12, 2017
On May 12, 2017, a ransomware attack called "WannaCry" (later identified as "WannaCry Version 2," as discussed below) began affecting computers around the globe. Those infected computers included many at the United Kingdom's National Health Service ("NHS") ... at least 80 out of 236 NHS trusts ... were affected [Case No. 2:18-mj-01479, U.S. District Court for the Central District of California; filing: COMPLAINT filed as to Defendant Park Jin Hyok in violation of 18:371; 18:1349. Approved by Magistrate Judge Rozella A. O]
WannaCry Version 2 ransomware · On or before May 12, 2017
Overt Act No. 13: On or before May 12, 2017, the hackers authored the ransomware used in a global, destructive cyber-attack known publicly as WannaCry Version 2. [Case No. 2:20-cr-00614, U.S. District Court for the Central District of California; filing: SEALED INDICTMENT filed as to Jon Chang Hyok]
WannaCry ransomware campaign (incl. 48 NHS trusts) · (May 2017; attributed 19 December 2017)
The UK's National Cyber Security Centre assesses it is highly likely that North Korean actors known as the Lazarus Group were behind the WannaCry ransomware campaign – one of the most significant to hit the UK in terms of scale and disruption.
WannaCry scale · (2017)
The WannaCry ransomware incident impacted 300,000 computers in 150 countries including 48 NHS trusts.
WannaCry attribution (joint with US, Australia, Canada, New Zealand, Japan; supported by Denmark) · December 2017
The UK has previously attributed the WannaCry ransomware incident to the Lazarus Group in December 2017, in parallel with the US, Australian, Canada, New Zealand, Japan and supported by Denmark.
WannaCry attributed to North Korea · In May of this year (2017)
After careful investigation, the United States is publicly attributing the massive WannaCry cyberattack to North Korea.
WannaCry scope (as described in the attribution briefing) · In May of this year (2017)
The malware encrypted and rendered useless hundreds of thousands of computers in hospitals, schools, businesses, and homes in over 150 countries.
WannaCry ransomware campaign · May this year (2017)
Based on advice from our intelligence agencies, and through consultations with our allies, we confirm that North Korea carried out the ‘WannaCry’ ransomware campaign.
소니픽처스 공격 주범 ‘라자루스’, 워너크라이 랜섬웨어 배후로 지목 · 2017-05-23
attribution sentence(s): 시만텍, ‘워너크라이’ 랜섬웨어 배후로 라자루스(Lazarus) 그룹 소행 확신 | 워너크라이 코드와 인프라 분석 결과, 라자루스 그룹과 높은 기술적 연관성 확인 | [보안뉴스 원병철 기자] 최근 전 세계적으로 확산된 ‘워너크라이 랜섬웨어’ 분석 결과, 사이버 공격 집단인 라자루스(Lazarus) 그룹과의 높은 연관성을 발견했다고 글로벌 사이버 보안 선도기업 시만텍이 밝혔다.
美백악관 "'워너크라이' 사이버공격은 북한 소행" 첫 공식확인(종합) · 2017-12-20
attribution sentence(s): [이데일리 차예지 기자] 미국 정부가 19일(현지시간) 지난 6월 전 세계 병원과 은행, 기업 네트워크를 마비시킨 ‘워너크라이’(WannaCry) 사이버 공격의 배후가 북한임을 처음으로 공식 확인했다. | 영국 외교부도 이날 워너크라이 사이버 공격을 북한 소행으로 단정했다. | 토머스 보서트 백악관 국토안보보좌관은 이날 백악관 브리핑룸에서 기자회견을 하고 “북한을 대신해 키보드를 작동하는 사람들이 북한이 아닌 장소에서 작업할 수 있어 책임규명의 어려움이 있을 수 있지만, 이 경우 북한 정권에 의해 지시된 것이라는 걸 확실히 말할 수 있다.
시만텍 “워너크라이, 라자루스 소행 확신” 북한 연계 가능성↑-경제ㅣ한국일보 · 2017-05-23
attribution sentence(s): 미국 사이버보안업체 시만텍이 최근 논란이 된 워너크라이 랜섬웨어 공격의 배후로 ‘라자루스’를 지목했다. | 북한 정부와 연계된 해킹단체로 알려진 라자루스는 2014년 소니픽처스 해킹, 지난해 2월 방글라데시 중앙은행 해킹 사건의 배후로 알려져 있다. | 시만텍은 22일(현지시간) “‘워너크라이 랜섬웨어 분석 결과 라자루스 그룹과의 높은 연관성을 발견했다”고 밝혔다.
미국 정부 “워너크라이 배후는 북한” 공식 발표-국제ㅣ한국일보 · 2017-12-19
attribution sentence(s): 토머스 보서트 백악관 국토안보보좌관은 18일 월스트리트저널(WSJ) 기고문을 통해 "신중한 수사 후에 미국은 오늘 대규모 워너크라이 사이버공격을 북한 때문이라고 공식화한다"고 밝혔다. | 로이터 연합뉴스미국 정부가 올해 초 전 세계 병원과 은행, 기업의 네트워크를 마비시킨 ‘워너크라이’ 사이버 공격의 배후로 북한을 공식 지목했다. | 토머스 보서트 백악관 국토안보보좌관은 18일(현지시간) 미 경제전문 월스트리트저널(WSJ)에 ‘워너크라이 배후가 북한이라는 점을 공식화한다’는 제목의 칼럼을 게재하고 “미국은 신중한 수사 후에 대규모 워너크라이 사이버공격이 북한 때문이라고 공식화한다”고 발표했다.
백악관 “워너크라이 랜섬웨어 공격은 북한 소행” · 2017-12-19
attribution sentence(s): 앵커 : 미국 백악관이 지난 5월 전 세계에서 발생한 '워너크라이'(WannaCry) 랜섬웨어 사이버 공격을 북한의 소행이라고 공식적으로 발표했습니다. | 토머스 보서트 백악관 국토안보보좌관은 19일 백악관에서 열린 기자회견에서 북한이 워너크라이 공격의 배후라는 증거를 갖고 수개월 동안 조사했으며 피해 국가와 민간 기업들도 동의했다고 밝혔습니다. | 토마스 보서트 : 신중한 조사 끝에, 미국은 공개적으로 대규모의 워너 크라이 사이버 공격이 북한의 소행이라고 봅니다.
영국 정부, 랜섬웨어 ‘워너크라이’ 공격 북한 소행 공식 확인 · 2017-10-27
attribution sentence(s): 지난 5월 전 세계 150여개국을 강타한 ‘워너크라이 랜섬웨어’ 공격은 북한의 소행이라고 영국 정부가 27일 공식 확인했다. | 벤 월리스 영국 내무부 차관은 이날(현지시간) 영국 BBC방송 라디오와의 인터뷰에서 “이 공격에 연루됐다고 우리가 믿고 있는 국가는 북한”이라며 “우리가 아는 한 확실하다”고 말했다. | BBC는 정보당국 관계자들의 말을 인용, NCSC는 북한 정부가 배후에 있는 것으로 알려진 해커집단 ‘라자루스’가 이번 공격을 감행한 것으로 보고 있다고 보도한 바 있다.
美정부 “워너크라이 배후는 북한” 공식 확인…돈은 못 벌어 · 2017-12-20
attribution sentence(s): 미국 정부가 지난 6월 전 세계 병원과 은행, 기업 네트워크를 마비시킨 사이버 공격인 ‘워너크라이’(WannaCry) 배후로 북한을 처음으로 공식 지목했다. | 미 정부 “워너크라이 배후는 북한” 미국 정부가 19일(현지시간) 지난 6월 전 세계 병원과 은행, 기업 네트워크를 마비시킨 ‘워너크라이’(WannaCry) 사이버 공격의 배후로 북한을 처음으로 공식 지목했다. | 토머스 보서트 백악관 국토안보보좌관(사진)은 이날 백악관 브리핑룸에서 기자회견을 하고 “면밀한 조사를 거쳐 이번 공격이 북한 정권의 지시로 이뤄진 소행이라고 공개적으로 규정한다”고 밝혔다.2017-12-20
美백악관 “‘워너크라이’ 사이버공격은 북한 소행” 첫 공식 지목(종합3보) · 2017-12-20
attribution sentence(s): 미국 정부가 19일(현지시간) 지난 6월 전 세계 병원과 은행, 기업 네트워크를 마비시킨 ‘워너크라이’(WannaCry) 사이버 공격의 배후로 북한을 공식 지목했다. | 그동안 워너크라이 랜섬웨어 공격 배후로 북한이 거론돼왔지만, 미정부가 공식적으로 확인하기는 처음이다. | 도널드 트럼프 행정부의 새 ‘국가안보전략’이 공개된 바로 다음 날 이뤄진 이번 발표는 북한의 핵·미사일 도발에 더해 ‘사이버 테러’에 대해서도 강력하게 대응하겠다는 미정부의 의지를 반영한 것으로 보인다.
유엔 북 차석대사 “‘워너크라이’ 북한 소행 증거 제시하라” · 2017-12-26
attribution sentence(s): 박성일 유엔주재 북한대표부 차석대사가 ‘워너크라이’(WannaCry) 사이버 공격 배후로 북한을 지목한 미국 정부에 반발하며 증거를 내놓으라고 요구했다. | 박 차석대사는 25일(현지시간) AP통신 인터뷰에서 미국이 북한을 ‘워너크라이’ 배후로 지목한 것을 두고 “극도로 대립하는 분위기”를 조성하려는 “근거 없는 도발”이라고 비판했다. | 최근 미국 정부는 올해 5월부터 영국 국민보건서비스(NHS)를 포함해 전 세계 병원, 은행, 기업 네트워크를 마비시킨 워너크라이 랜섬웨어 공격 배후로 북한을 공식 지목했다.
WannaCry · 2017
Para 114: “In the 2017 WannaCry attack by the Reconnaissance General Bureau, the ransom demand was made in cryptocurrency.” Footnote 106: “In 2017, an assessment by the U.S. National Security Agency reported in the media linked the WannaCry ransomware to the Reconnaissance General Bureau ...” Annex 34 (US DoD report excerpt): “In 2017, North Korea carried out the malicious “WannaCry” ransomware attack that spread across the world damaging civilian infrastructure, including the United Kingdom’s National Health Service and Chinese firms.”
WannaCry ransomware · May 2017
(MSMT/2025/2, report p. 15, 17) p. 17: “The WannaCry ransomware attack in May 2017 infected over 300,000 computers across more than 150 countries and disrupted the services of major companies and institutions including FedEx, Nissan, Renault, and the UK’s National Health Service (NHS).”
WannaCry and Lazarus Group – the missing link? · 2017-05-15T19:32:31
Moments ago, Neel Mehta, a researcher at Google posted a mysterious message on Twitter. The cryptic message in fact refers to similarity between samples that have shared code between themselves. The two samples Neel refers to post are a Wannacry cryptor sample and a Lazarus APT group sample.
WannaCry FAQ - Take-aways and Learnings · 2017-05-17T07:00:00.000Z
WannaCry FAQ: How does WannaCry spread? WannaCry has multiple ways of spreading. Its primary method is to use the Backdoor.Double.Pulsar backdoor exploit tool released last March by the hacker grou… | From article: Some evidence linking this to North Korea has also been found by Neel Metha, a Google researcher.
What you need to know about the WannaCry Ransomware · 23 Oct 2017
The WannaCry ransomware struck across the globe in May 2017. Learn how this ransomware attack spread and how to protect your network from similar attacks. | From article: What you need to know about the WannaCry Ransomware | SECURITY.COM Skip to main content UPDATE: May 23, 2017 00:30 GMT: Symantec has uncovered further links to more closely tie the WannaCry attacks with the Lazarus group.
Values found later for empty fields
dollar figures: around US$300 in bitcoin within three days, or US$600 within seven days
demands a payment of around US$300 in bitcoin within three days, or US$600 within seven days
dollar figures: 327 payments totalling US$130,634.77
As of 14 June 2017, after the attack had subsided, a total of 327 payments totalling US$130,634.77 (51.62396539 BTC) had been transferred
dollar figures: up to US$4 billion
According to cyber-risk-modelling firm Cyence, economic losses from the cyber attack could reach up to US$4 billion, with other groups estimating the losses to be in the hundreds of millions.
Suggest a correction on GitHub