Wannacry
WannaCry ransomware is a cyber attack that spreads by exploiting vulnerabilities in the Windows operating system. At its peak in May 2017, WannaCry became a global threat. Cybercriminals used the ransomware to hold an organization's data hostage and extort money in the form of cryptocurrency. WannaCry spreads using EternalBlue, an exploit leaked from the National Security Agency (NSA). EternalBlue enables attackers to use a zero-day vulnerability to gain access to a system. It targets Windows computers that use a legacy version of the Server Message Block (SMB) protocol.
Victims
33
First Discovered
victim2017-05-12
Last Discovered
victim2018-02-23
Avg Delay
between attack and claimN/A
Infostealer
for victim with domain100.0%
Known Locations (1)
Target (Available)
Top 5 Activity Sectors
- Government Facilities 7
- Communication 5
- Commercial Facilities 4
- Transportation Systems 3
- Financial 3
Top 5 Countries
-
United States
6
-
China
4
-
Russian Federation
3
-
Brazil
3
-
United Kingdom
2
Heatmap (Available)
Ransom Notes (0)
No ransom notes available.
Tools Used (Not Available)
No tools used available.
Vulnerabilities Exploited (0)
No vulnerabilities exploited available.
TTPs Matrix (0)
No TTPs available.
Negotiation Chats (0)
No negotiation chats available.
YARA Rules (0)
No YARA rules available.
Indicators of Compromise (IoCs) (0)
No IoCs available for this group.
Victims (33)
State of Connecticut (12 State Agencies, including the Department of Administrative Services)
Wannacry
Discovery Date: 2018-02-23
N/A
Chinese traffic police, immigration and public security bureaus
Wannacry
Discovery Date: 2017-05-12
N/A
