WANNACRY Ransomware | #cybersecurity #wannacry #ransomware #2015 #korea | WannaCry is a global ransomware computer worm that launched in May 2017. It targeted computers running unpatched versions of the Microsoft Windows operating system. How It Worked • Propagation: It spread rapidly across networks on its own without requiring user interaction, using an exploit called EternalBlue (a Server Message Block [SMB] vulnerability originally developed by the U.S. National Security Agency [NSA] and leaked by a group called The Shadow Brokers). • Encryption and Demand: Once inside a system, it encrypted user files and demanded a ransom payment ranging from $300 to $600 in Bitcoin to restore access. • The "Kill Switch": A security researcher named Marcus Hutchins stopped the rapid global spread hours after it began by registering a hardcoded, unregistered domain name that acted as a kill switch. Impact • Scale: It infected more than 230,000 computers across roughly 150 countries within a single day, causing billions of dollars in damage. • Notable Victims: Major institutions were crippled, including the United Kingdom's National Health Service (NHS), Spain's Telefónica, FedEx, and Renault. In the UK, the attack forced hospitals to divert ambulances and cancel thousands of appointments. • Attribution: Intelligence agencies in the U.S. and UK attributed the attack to North Korea (linked to the Lazarus Group). Prevention and Security • Patches: Microsoft had released a security patch (MS17-010) addressing the vulnerability two months prior in March 2017, and later issued emergency updates even for unsupported systems like Windows XP. • Defense: Preventing similar attacks relies on regular system patching, disabling legacy protocols like SMBv1, network segmentation, and maintaining secure offline backups. - @invokedynamics