Article
Ransomware examples: attacks, types and groups
Ransomware examples explained: five documented attacks, the main types of ransomware and the groups named in recent government advisories.
Read more
Malware profile
WannaCry
Also known as WanaCry, WanaCrypt, WanaCrypt0r
WannaCry is ransomware that spreads on its own across a network like a worm and encrypts the files it finds.
In short
WannaCry is ransomware that spreads on its own across a network like a worm and encrypts the files it finds. MITRE says it was first seen in a global attack in May 2017 that affected more than 150 countries. The US and UK governments have attributed that attack to North Korean actors.
- Names9names in public reportsWannaCry · WanaCry · WanaCrypt
- Techniques16ATT&CK techniques listedExecution · Persistence · Defense Impairment
- Infection Steps6in the delivery chainDropper starts · Service installed
- Linked Groups1groups that use itLazarus Group
In one minute
- What it is
- Ransomware with a worm part that locks files and spreads across networks by itself.
- What it does
- Encrypts user files, asks for a Bitcoin ransom, deletes recovery options and copies itself to other computers over SMBv1.
- Who uses it
- Attributed by the UK government to the Lazarus Group (19 December 2017) and by the US government to the North Korean government (CISA alert updated 7 June 2018). MITRE lists Lazarus Group.
- How it gets in
- The SMBv1 flaw MS17-010 (EternalBlue) on exposed Windows systems. CISA also says phishing may have been one way in.
- What to do first
- Install the MS17-010 update. If you cannot, disable SMBv1 and block SMB at the network edge, as CISA advises.
What it does
WannaCry has two parts. A worm part finds other computers on the same network segment and copies the malware to them. A ransomware part locks the user’s files and asks for payment in Bitcoin.
MITRE says the outbreak first hit IT networks and then spread to industrial networks through the same SMBv1 flaw. The CISA analysis says the dropper first tries to reach a set web address and stops if it succeeds.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| WannaCry | MITRE ATT&CK software S0366 and CISA alert TA17-132A[1, 2] |
| WanaCry | MITRE Associated Software[1] |
| WanaCrypt | MITRE Associated Software[1] |
| WanaCrypt0r | MITRE Associated Software[1] |
| WCry | MITRE Associated Software and CISA alert TA17-132A[1, 2] |
| WannaCrypt | CISA alert TA17-132A[2] |
| Wanna Decryptor | CISA alert TA17-132A[2] |
| .wnCry | File extension name in CISA alert TA17-132A[2] |
| WannaCry 2.0 | US Department of Justice and Treasury press releases of 6 September 2018[4, 5] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Persistence
Defense Impairment
Discovery
System Network Configuration Discovery T1016
It works out which local network segment it is on.[1]
Remote System Discovery T1018
It scans its local network segment for other systems to attack and copy itself to.[1]
File and Directory Discovery T1083
It searches for many kinds of user files by extension before encrypting them.[1]
Peripheral Device Discovery T1120
A thread checks every few seconds for newly attached drives and encrypts files on them.[1]
Lateral Movement
Exploitation of Remote Services T1210
It uses an SMBv1 flaw to spread to other systems on a network.[1, 2]
Lateral Tool Transfer T1570
It copies itself to remote computers after it gains access through the SMB exploit.[1]
Remote Service Session Hijacking: RDP Hijacking T1563.002
It lists current remote desktop sessions and tries to run the malware in each one.[1]
Command and Control
Impact
Data Encrypted for Impact T1486
It encrypts user files and demands a ransom in Bitcoin to decrypt them.[1]
Service Stop T1489
It tries to stop processes tied to Exchange, SQL Server and MySQL so it can encrypt their data.[1]
Inhibit System Recovery T1490
It uses vssadmin, wbadmin, bcdedit and wmic to delete and disable system recovery features.[1]
How it spreads
CISA and MITRE say WannaCry spread by exploiting the MS17-010 flaw in SMBv1, also known as EternalBlue. A security update for the flaw was released on 14 March 2017, two months before the outbreak. Once one computer was infected, the malware scanned its local network for other systems to exploit and copy itself to. CISA also says that, according to open sources, one possible way in may have been phishing.
How an infection runs
The order of steps in a typical infection, as the sources describe it.
Dropper starts
The dropper first tries to reach a hard coded web address. If the connection works, it stops. If it fails, it goes on to infect the system.[2]
Service installed
The dropper installs itself as a Windows service named mssecsvc2.0.[2]
Network scan
As a service, it builds a list of IP ranges on the local network and tries to connect on UDP ports 137 and 138 and TCP ports 139 and 445.[2]
Worm spreads
If port 445 answers, it starts a thread that spreads by exploiting the SMBv1 flaw MS17-010.[2]
Ransomware dropped
The dropper extracts the ransomware component from its own resources, saves it as tasksche.exe and runs it with the /i option.[2]
Files locked
The ransomware encrypts user files and demands a Bitcoin ransom.[1]
Timeline
- 14 March 2017
Security update released
A security update for the SMB flaw MS17-010 was released two months before the outbreak, according to CISA.[2]
- 12 May 2017
Outbreak begins
CISA says the latest version was discovered on the morning of 12 May 2017 and spread rapidly over several hours. CISA published alert TA17-132A the same day.[2]
- 13 May 2017
Patches for older systems
CISA says patches for Windows XP, Windows 8 and Windows Server 2003 were released.[2]
- 16 May 2017
Further analysis
CISA added further analysis and new indicators to its alert.[2]
- 19 December 2017
UK attribution
The UK Foreign Office said the NCSC assesses it is highly likely that the Lazarus Group were behind WannaCry.[6]
- 7 June 2018
CISA alert updated
CISA updated TA17-132A to reflect the US attribution to the North Korean government.[2]
- 6 September 2018
Who uses it
Seen in
Detection and defense
Questions
What is WannaCry?
Ransomware with worm like features. MITRE says it was first seen in a global attack in May 2017 that affected more than 150 countries, and that it spreads using the SMBv1 exploit EternalBlue.
How did WannaCry spread?
It exploited the SMBv1 flaw MS17-010 to move from one computer to others on a network. A security update had been released on 14 March 2017. CISA also says phishing may have been one entry route, according to open sources.
Who was behind WannaCry?
Governments attributed it to North Korea. The UK Foreign Office said on 19 December 2017 that the NCSC assesses it is highly likely that the Lazarus Group were behind it. CISA says the US Government publicly attributed it to the North Korean government, in an update of 7 June 2018. On 6 September 2018 the US Department of Justice charged Park Jin Hyok, saying the conspiracy is connected to WannaCry 2.0.
How many computers did it hit?
Sources differ. CISA reported tens of thousands of infections in over 150 countries. The UK Foreign Office said 300,000 computers in 150 countries, including 48 NHS trusts. The Department of Justice said hundreds of thousands.
Does paying the ransom help?
CISA says paying does not guarantee the files will be released.
In our research
- Ransomware examples: attacks, types and groups October 2026
- The Lazarus Group: Espionage, Sabotage, and Cybercrime Under One Umbrella October 2025
- Why Does Ransomware Still Threaten Cybersecurity? June 2025
- Cracking the Code: How Cyber Threat Intelligence Could Save Your Business October 2024
- When Cyber Threats Go Viral: What to Do When the Internet Turns on You October 2024
- Ransomware Royale: The Cyber Heist You Can’t Afford to Ignore September 2024
Sources
- WannaCry, Software S0366 MITRE ATT&CKSupports: Names, platform, description, techniques, group and the industrial network note.
- Indicators Associated With WannaCry Ransomware (TA17-132A) CISASupports: Outbreak dates, dropper analysis, YARA signatures, mitigations, attribution update of 7 June 2018.
- Lazarus Group, Group G0032 MITRE ATT&CKSupports: MITRE description of Lazarus Group.
- North Korean Regime-Backed Programmer Charged With Conspiracy to Conduct Multiple Cyber Attacks and Intrusions US Department of JusticeSupports: 6 September 2018 charges and the link to WannaCry 2.0.
- Treasury Targets North Korea for Multiple Cyber-Attacks US Department of the TreasurySupports: 6 September 2018 sanctions and the link to WannaCry 2.0.
- Foreign Office Minister condemns North Korean actor for WannaCry attacks UK Foreign & Commonwealth OfficeSupports: UK attribution of 19 December 2017 and impact figures.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.