WannaCry: The Ransomware That Hit Hospitals

What Is This Threat?

WannaCry is a ransomware worm that combined file encryption with a self-spreading mechanism to cause one of the most damaging cyberattacks in history. Unlike traditional ransomware that requires a victim to click something, WannaCry automatically spread across networks by exploiting a vulnerability in Windows — meaning it could infect every unpatched computer in a hospital, factory, or office without any human interaction.

How It Worked

The Exploit:

WannaCry used EternalBlue (CVE-2017-0144), a hacking tool developed by the US National Security Agency (NSA) that was stolen and leaked by the Shadow Brokers group in April 2017. EternalBlue exploited a critical flaw in Windows' SMB (Server Message Block) file-sharing protocol.

Microsoft had released a patch (MS17-010) two months before the WannaCry attack, in March 2017. Organizations that had not applied it were completely vulnerable.

The Attack (12 May 2017):

WannaCry scanned the internet for Windows machines with port 445 (SMB) exposed.

It exploited EternalBlue to gain access without any user interaction.

It installed a backdoor (DoublePulsar, also an NSA tool), then dropped the ransomware payload.

All files were encrypted with AES-128. A ransom of $300–$600 in Bitcoin was demanded with a 3-day deadline.

Within hours, WannaCry spread laterally across internal networks, encrypting every reachable machine.

The Kill Switch:

Security researcher Marcus Hutchins (MalwareTech), then 22 years old, noticed the malware checked a specific unregistered domain before running. He registered the domain for $10.69 — this accidentally activated a kill switch built into the malware, slowing the spread dramatically. Without this, the damage would have been far worse.

Real-World Impact

UK National Health Service (NHS): 80 of 236 NHS trusts were infected. An estimated 19,000 medical appointments were cancelled, including cancer treatments and surgeries. Ambulances were diverted. Total cost: estimated £92 million.

Deutsche Bahn (Germany): Departure boards and ticket machines displayed ransom messages instead of train information.

Telefónica (Spain): Major internal systems disrupted; staff told to shut down computers.

Renault (France): Production at several factories halted.

Russian Ministry of Internal Affairs: Over 1,000 computers affected.

Total global damage: Estimated $4–8 billion across 150 countries.

Attribution: The US, UK, and Australian governments formally attributed WannaCry to North Korea's Lazarus Group in December 2017. The motive was financial — North Korea uses cybercrime to circumvent sanctions.

Still Active: WannaCry variants without the kill switch continue to infect unpatched Windows XP and Windows 7 systems today. Organizations running legacy systems remain at risk.

Why It Matters Today

WannaCry demonstrated three hard lessons that remain relevant:

Unpatched systems are weapons waiting to be used against you. The patch was available for 2 months.

One unpatched machine can bring down an entire network. Hospitals had to turn away patients.

Nation-state cyberweapons end up in criminal hands. EternalBlue was an NSA tool used against civilian infrastructure.

Red Flags / Warning Signs

Files suddenly renamed with .WCRY or .WNCRY extension.

A ransom note appears on screen demanding Bitcoin payment.

Multiple computers on a network go offline simultaneously.

Windows Event Logs show mass SMB connection attempts from internal IPs.