The WannaCry ransomware attack was a worldwide cyberattack by the WannaCry ransomware cryptoworm, which targeted computers running the Microsoft Windows operating system in May 2017. The attack encrypted data and demanded ransom payments in the Bitcoin cryptocurrency. It is widely considered one of the largest and most devastating cyber epidemics in internet history.
The attack began on Friday, May 12, 2017, and propagated with unprecedented speed. Unlike traditional ransomware that requires users to click a malicious link or download an infected file, WannaCry functioned as a worm. It utilized the EternalBlue exploit—a highly classified cyberweapon developed by the U.S. National Security Agency (NSA) that had been stolen and leaked to the public by a hacker group known as The Shadow Brokers earlier that year. The attack crippled over 200,000 computers across 150 countries, severely impacting hospitals, transportation networks, and multinational corporations before it was accidentally halted by a 22-year-old security researcher named Marcus Hutchins.
Background: The Shadow Brokers and EternalBlue
The roots of the WannaCry epidemic trace back to the United States National Security Agency (NSA). The NSA had discovered a critical vulnerability in Microsoft's implementation of the Server Message Block (SMBv1) protocol, a system used by Windows computers to share files and printers across local networks. The NSA weaponized this vulnerability into an exploit code-named EternalBlue, which allowed attackers to remotely execute arbitrary code on unpatched Windows machines without any user interaction.
In August 2016, a mysterious hacking entity calling itself The Shadow Brokers surfaced online, claiming to have breached the "Equation Group" (a widely accepted alias for the NSA's Tailored Access Operations unit). On April 14, 2017, The Shadow Brokers leaked a massive cache of these highly classified NSA hacking tools to the public, including the EternalBlue exploit.
Anticipating the leak, Microsoft had already released an emergency security patch (MS17-010) on March 14, 2017, designed to fix the SMBv1 vulnerability in supported operating systems. However, millions of organizations globally had delayed applying the patch, and many systems were running unsupported legacy software (like Windows XP and Windows Server 2003) which did not initially receive the update.
The May 12 attack and propagation mechanism
The initial infection vector for WannaCry remains a subject of debate, though it is believed to have started with exposed, internet-facing SMB ports in Asia. The attack officially ignited on the morning of May 12, 2017.
Once WannaCry infected a single computer on a network, it immediately leveraged the EternalBlue exploit to scan the local subnet (and random IP addresses on the wider internet) for other vulnerable machines over TCP port 445. It would then copy itself to those machines, execute silently, and repeat the process. This worm-like capability allowed it to tear through corporate networks like wildfire, bypassing firewalls from the inside.
The WannaCry Ransom Interface
The software displayed this screen, demanding $300 in Bitcoin. A countdown timer threatened to double the price, and eventually delete the decryption key entirely.
Upon successful execution, the WanaCrypt0r 2.0 payload would encrypt files with dozens of common extensions (documents, archives, images, databases) using unbreakable AES-128 and RSA encryption. The software would change the user's desktop wallpaper and display a bright red application window demanding a ransom of $300 USD, payable in Bitcoin, within three days. If unpaid, the price would double to $600. After seven days, the malware threatened to delete the decryption keys forever, permanently destroying the data.
Global impact and the NHS crisis
The speed and scale of the infection caught the world completely off guard. Within hours, over 200,000 systems were locked down. The financial damage and operational disruption were catastrophic, with some cybersecurity firms estimating total global costs reaching up to $4 billion.
The most high-profile and concerning victim was the United Kingdom's National Health Service (NHS). Dozens of NHS trusts, hospitals, and clinics were paralyzed because their IT infrastructure relied heavily on outdated and unpatched Windows systems (including Windows 7 and XP). Doctors were locked out of patient records, MRI scanners were rendered inoperable, ambulances had to be diverted, and thousands of non-emergency surgeries and appointments were canceled. It represented the first time a cyberattack caused a physical, life-threatening crisis on a national scale.
Other notable victims included the Spanish telecom giant Telefónica, the US logistics company FedEx (which reported $300 million in losses), German railway operator Deutsche Bahn (where departure boards displayed the ransom screen), and automakers Renault and Nissan, who had to halt production lines in several European factories.
Marcus Hutchins and the "Kill Switch"
As the world panicked, the epidemic was unexpectedly halted by a 22-year-old British cybersecurity researcher named Marcus Hutchins, known online by his handle MalwareTech. Hutchins had obtained a sample of the WannaCry malware and began reverse-engineering its code in an isolated sandbox environment.
Hutchins noticed that before the malware executed its encryption payload, it attempted to ping a specific, hardcoded, extremely long gibberish domain name: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com. Finding that the domain was completely unregistered, Hutchins purchased it for $10.69 and pointed it to a "sinkhole" server he operated to track botnets.
Instantly, the global infection rate plummeted. Hutchins realized he had accidentally triggered a "kill switch." The malware's authors had programmed WannaCry to check if that specific domain was live. If the domain was unregistered (as it was initially), the malware assumed it was in a real environment and proceeded to encrypt and spread. If the domain responded (which happened after Hutchins registered it), the malware assumed it was being analyzed in a security researcher's "sandbox" (which often spoof DNS responses) and would immediately shut itself down to avoid analysis. By registering the domain, Hutchins effectively neutralized the primary WannaCry strain globally in a matter of hours.
Attribution to North Korea
In the weeks following the attack, cybersecurity researchers at Symantec and Kaspersky Lab identified distinct similarities between the code used in WannaCry and malware previously used by the Lazarus Group, an elite state-sponsored cybercrime syndicate tied to the Reconnaissance General Bureau of North Korea. The Lazarus Group was notoriously known for the 2014 Sony Pictures hack and the 2016 Bangladesh Bank cyber heist.
In December 2017, the United States, United Kingdom, and Australia formally and publicly accused North Korea of being behind the WannaCry attack. The U.S. Department of Justice later indicted Park Jin Hyok, a North Korean computer programmer, for his involvement in developing WannaCry and other Lazarus operations.
Legacy and patch management
WannaCry served as a brutal, global wake-up call regarding the critical importance of regular software patching and the dangers of maintaining legacy IT systems in critical infrastructure. The severity of the crisis prompted Microsoft to take the highly unusual step of releasing security updates for Windows XP, Windows 8, and Windows Server 2003—operating systems that had reached their end-of-life and were no longer officially supported.
Furthermore, the incident sparked intense debate regarding the ethics of intelligence agencies hoarding "zero-day" vulnerabilities. Tech leaders, including Microsoft President Brad Smith, criticized the NSA and the CIA for developing digital weapons that could be stolen and turned against civilian infrastructure, comparing the EternalBlue leak to "the U.S. military having some of its Tomahawk missiles stolen." Despite the kill switch, mutated variants of WannaCry without the domain check continued to circulate and infect unpatched systems for years after the initial 2017 outbreak.