WannaCryptorMalware
- wana decrypt0r
- wanacry
- wanacrypt
- wanacrypt0r
- WannaCry
- wannacrypt
- wcry
- wcrypt
WannaCry is ransomware that contains a worm component enabled by the EternalBlue exploit. It attempts to use vulnerabilities in the Windows SMBv1 server to remotely compromise systems, encrypt files, and spread to other hosts. Systems that have installed the MS17-010 patch are not vulnerable to the exploits used.From MISP Galaxy
Last reported 5 days ago, by Rapid718 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1053.005Scheduled Task
“For Emotet, this includes the use of malicious services and scheduled tasks used to automatically launch its payload and spread throughout victims’ networks.”
- T1195Supply Chain Compromise
“Attackers tested our limits time and time again with bolder, more cutting-edge cyberattacks: ransomware, supply chain compromises, zero-day vulnerabilities, and more.”
- T1218.002Control Panel
“Through investigative activities, Group-IB specialists gained access to the Kronos control panel.”
- T1219Remote Access Tools
“Compromised remote access tools that provided persistent backdoors for future attacks”
- T1505.003Web Shell
“Instead, identified tradecraft thus far, as documented by Huntress and others, indicates initial access was used to deploy a web shell.”
- T1561Disk Wipe
“…APT38, now considered as splitted between CryptoCore and Jade Sleet, which was a financially-motivated threat cluster, which leveraged disk-wipe techniques (KillDisk) as an anti-forensics measure in 2017.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
18 reports, newest first · the exact sentence from each-
Your Next Insider Threat Won’t be Human: Securing AI Agents From the Outside in“In May 2017, WannaCry was stopped by luck.”
-
Panorama de ciberamenazas en América Latina: balance del primer semestre de 2026“…e células selectivas: Operaciones vinculadas a BlackMatter, Conti, Phobos, Akira, DragonForce y muestras residuales de LockBit o WannaCry se manifestaron mediante incidentes puntuales.”
-
Securing the unpatchable in an age of AI-driven vulnerabilities“The U.K.’s NHS health system was significantly affected by the WannaCry worm in 2017, with a significant minority of systems running the end-of-life operating system Windows XP contributing to the problem.”
-
Microsoft Releases Emergency Patch to Fix RDS Vulnerability“Read more on Microsoft RDS issues: “Wormable” Bug Could Enable Another WannaCry.”
-
Beyond Lazarus: How North Korea Organizes Its Cyber Operations“… hacking universities, the emergence of first DPRK-led destructive cyber operations (Operation DarkSeoul 2013, Sony PIctures Hack 2014, WannaCry 2017), the multiplication of intelligence gathering operations, and the systematic use of cyber campaigns for revenue generation.”
-
Stranger Threats Are Coming: Group-IB Cyber Predictions for 2026 and Beyond“Incidents like WannaCry (which exploited a Windows vulnerability and caused a large-scale outbreak in just hours), NotPetya (malware acted as a dual means for ransomware and cyberwarfare), and Mirai (exploited vulnerable IoTs to initiate DDoS attacks) caused billions of dollars i…”
-
Ten Years of Resilience, Innovation & Community-Driven Defense“This exploit was based on a Microsoft zero-day flaw (CVE-2017-0144) and was also used in the WannaCry attack the month prior.”
-
Move It on Over: Reflecting on the MOVEit Exploitation“For a concrete example, we can look to critical vulnerabilities in the Windows operating system, such as MS17-010 (enabling the WannaCry event) or even MS08-67 (the infamous vulnerability enabling Conficker).”
-
Detect domain generation algorithm (DGA) activity with new Kibana integration“DNS mitigation was also performed in the case of the 2017 WannaCry ransomware global outbreak.”
-
Keeping up with BlueKeep“Considering previous wormable attacks like WannaCry, the Huntress team has high confidence that hackers will start attacking unpatched computers and servers in the very near future.”
-
Rapid Response: ASUS Live Update Attack (Operation ShadowHammer)“Periodically, a large scale cybersecurity issue requires “all hands on deck” from the Huntress Team (see WannaCry, Kaseya Cryptominer, GANDGRAB outbreak).”
-
MSP Moment“…as re-emerged as a formidable piece of crimeware, thanks to its new self-propagation techniques (undoubtedly inspired by the success of WannaCry and Petya).”
-
Insecure venture“…stage by blocking all information needed for work and demanding a ransom for that (for example, that is what happened during the recent WannaCry outbreak).”
-
Kronos devouring its children“The man who "saved the world" from the WannaCry outbreak has been arrested on suspicion of being the author of Kronos banking Trojan”
-
Security Awareness Training Will Prevent Ransomware“Unless you have been living under a rock for the past month, it is hard not to notice all of the news about the WannaCry ransomware attack.”
-
Petya starts with Ukraine and then goes global“As with WannaCry.”
-
Echoes of cyberwar“Why WannaCry was more dangerous than other ransomware?”
-
In a Risk Group“For only 3 days of May 2017, the WannaCry ransomware attacked 200,000 computers in 150 countries of the world.”
Indicators in its reports
named in the reports above- 23.237.102[.]130in 1 report
- 37.120.154[.]98in 1 report
- 38.75.137[.]97in 1 report
- 45.86.208[.]162in 1 report
- 50.7.159[.]34in 1 report
- 91.239.130[.]102in 1 report
- 103.214.44[.]138in 1 report
- 167.88.61[.]117in 1 report
- 185.135.76[.]89in 1 report
- 188.43.33[.]252in 1 report
- 211.21.6[.]181in 1 report
- 70.32.3[.]15in 1 report
- 66.118.255[.]35in 1 report
- hxxps://www.hrnk[.]org/documentations/the-reconnaissance-general-bureau-the-kim-regimes-precious-treasured-sword/in 1 report
- www.hrnk[.]orgin 1 report
- hxxps://ieeexplore.ieee[.]org/document/8756954/in 1 report
- hxxps://www.kinu.or[.]kr/eng/module/report/view.do?idx=125351&nav_code=eng1674806000in 1 report
- www.kinu.or[.]krin 1 report
- hxxps://www.csis[.]org/analysis/hidden-enablers-third-countries-north-koreas-cyber-playbookin 1 report
- hxxps://understandingwar[.]org/research/china-taiwan/north-koreas-constitutional-amendments-cement-the-regimes-strategic-posture/in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.