{
  "family": "wannacry",
  "sample_count": 4876,
  "category": "ransomware_worm",
  "description": "WannaCry is ransomware first seen in a global attack in May 2017 that, per MITRE ATT&CK, affected more than 150 countries. It contains worm-like features that let it spread across networks using the SMBv1 exploit known as EternalBlue. Once on a machine it encrypts files and demands a Bitcoin ransom. The outbreak slowed after a researcher registered a 'kill-switch' domain found in the code. Systems that had applied the relevant Microsoft SMB security update were protected from the exploit it relied on.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "WannaCry",
    "WanaCrypt0r",
    "WCry"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is WannaCry?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A ransomware worm from May 2017 that encrypted files and demanded Bitcoin, and spread itself automatically across networks."
      }
    },
    {
      "@type": "Question",
      "name": "How did WannaCry spread so quickly?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It used the wormable SMBv1 exploit EternalBlue to move between machines without user interaction, which is why it reached more than 150 countries so fast."
      }
    },
    {
      "@type": "Question",
      "name": "What is EternalBlue?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A Windows SMBv1 vulnerability exploit; applying the Microsoft patch released before the outbreak protected systems from it."
      }
    },
    {
      "@type": "Question",
      "name": "What was the WannaCry kill-switch?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The malware checked for a specific unregistered domain. A researcher registered it, which caused many samples to stop encrypting and slowed the global spread."
      }
    },
    {
      "@type": "Question",
      "name": "Could WannaCry have been prevented?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Largely yes — the SMB vulnerability it exploited had a Microsoft patch available before the outbreak, so patched systems were not vulnerable to its spreading mechanism."
      }
    },
    {
      "@type": "Question",
      "name": "Is paying the WannaCry ransom recommended?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security guidance generally discourages paying ransoms; for WannaCry specifically, paying did not reliably restore files. Restore from clean backups and consult professional incident-response resources instead."
      }
    },
    {
      "@type": "Question",
      "name": "How do I protect against ransomware worms like WannaCry?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Apply security updates promptly, disable obsolete protocols like SMBv1, segment networks, and keep tested offline backups."
      }
    },
    {
      "@type": "Question",
      "name": "Where can I read the authoritative details?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MITRE ATT&CK's WannaCry entry (S0366), linked here, documents its techniques and references."
      }
    }
  ],
  "faq_count": 8,
  "mitre_attack": [
    "T1210",
    "T1486",
    "T1083",
    "T1490"
  ],
  "cisa_advisory": "https://www.cisa.gov/news-events/alerts/2017/05/12/multiple-ransomware-infections-reported",
  "last_updated": "2026-06-09",
  "sources": [
    {
      "name": "MITRE ATT&CK: WannaCry (S0366)",
      "url": "https://attack.mitre.org/software/S0366"
    }
  ],
  "mitre_url": "https://attack.mitre.org/software/S0366",
  "threat_actors": [
    "Lazarus Group"
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure"
  ],
  "target_geographies": [
    "Global"
  ],
  "motivation": "Financial Extortion / Disruption"
}