WannaCry is the cryptoworm responsible for the May 2017 global ransomware outbreak that infected over 200,000 systems across 150 countries, including the UK National Health Service, FedEx, Telefonica, and many manufacturing organizations. It propagates using the EternalBlue SMB exploit leaked from the NSA, encrypting files and demanding Bitcoin ransom. Investigators have attributed WannaCry to the North Korean Lazarus Group. Protection requires the MS17-010 patch, disabling SMBv1, and network segmentation to limit lateral movement.
This family has been observed using the following ATT&CK techniques: T1210 T1486 T1083 T1490
CISA has published an advisory on this family: https://www.cisa.gov/news-events/alerts/2017/05/12/multiple-ransomware-infections-reported
WannaCry is the cryptoworm responsible for the May 2017 global ransomware outbreak that infected over 200,000 systems across 150 countries, including the UK National Health Service, FedEx, Telefonica, and many manufacturing organizations. It propagates using the EternalBlue SMB exploit leaked from the NSA, encrypting files and demanding Bitcoin ransom. Investigators have attributed WannaCry to the North Korean Lazarus Group. Protection requires the MS17-010 patch, disabling SMBv1, and network segmentation to limit lateral movement.
WannaCry spread in May 2017 using the EternalBlue SMB exploit (MS17-010) and the DoublePulsar backdoor, both leaked from the NSA by the Shadow Brokers.
Files renamed with .wncry, .wcry, .wnry, or .wncryt extensions, ransom screen demanding $300-$600 in Bitcoin, and AV detections for WannaCry, WanaCrypt, or WCry are signatures.
If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance.
Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/wannacry.json
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families extracted from the EMBER 2018 benchmark. The catalog is also published on Hugging Face and Kaggle.