WannaCry: five facts about a failed ransomware
In May 2017 WannaCry hit 300,000 computers in 150 countries within 72 hours and stopped a third of NHS hospitals in the UK — yet collected less than $100,000 from its victims. Here's what went wrong for the attackers and what it means for businesses today.
Few cyberattacks show the difference between "destructive" and "profitable" as
clearly as WannaCry. Over three days in May 2017 the ransomware infected about
300,000 computers in 150 countries — from Boeing and FedEx to the UK's National
Health Service — yet earned less than $100,000. Here are five facts that explain
why one of the most visible attacks in the history of the internet turned out to be
a financial failure for its creators.
## 1. The breach was possible because of one unpatched Windows vulnerability
WannaCry spread through EternalBlue — a tool originally developed by the US National
Security Agency to exploit a vulnerability in the SMB (Server Message Block)
protocol, which handles file sharing on a network. In April 2017, a month before the
attack, the Shadow Brokers group stole EternalBlue from the NSA and published the
exploit openly. Microsoft quickly released a patch for Windows 7 and 10 — but, as
usual, far from every organization managed or was able to install it. Computers
running Windows XP, which initially got no patch at all, stayed vulnerable by default.
## 2. Healthcare was hit hardest
A telling example is the UK's National Health Service (NHS), which at the time of the
attack was running unsupported 16-year-old Windows XP and unpatched Windows 7. A third
of NHS hospitals in England and Scotland stopped for several days, and about 19,000
appointments and planned operations were cancelled. The damage to the NHS and UK
taxpayers was estimated at no less than £92 million (about $128 million). In infected
hospitals, planned admissions fell by 9% and emergency ones by 4%; overall patient
flow dropped by 6% a day for each affected hospital.
## 3. The attackers made less than $100,000 from 300,000 infections
The attackers demanded $300 to $600 in bitcoin, threatening to destroy the files after
three days. Large organizations — exactly the ones most likely to have unpatched
systems, including the NHS — usually had backups and simply refused to pay, restoring
data from backup and closing the vulnerability. Small and medium businesses paid more
readily, afraid of losing data for good. The total for the whole attack was about 200
payments adding up to less than $100,000 across 300,000 infected machines. Worse,
WannaCry's code had no mechanism tying a payment to a specific victim — so paying did
not guarantee decryption for anyone at all.
## 4. The attack was stopped by chance, not by the victims' defenses
A researcher then known only as MalwareTech (later revealed to be Marcus Hutchins)
noticed that before spreading, WannaCry contacted the same meaningless-looking domain.
Out of curiosity he registered that domain — and in doing so accidentally triggered
the killswitch built into the malware, an emergency stop mechanism. A $10.69
investment in a domain registration sharply slowed WannaCry's spread worldwide. One
theory is that the creators built the killswitch so they could stop the attack
themselves if it got out of control.
## 5. Today WannaCry is barely dangerous — but the lesson still matters
Microsoft's patches closed the vulnerability EternalBlue exploited, and researchers
developed ways to decrypt files without paying the ransom — provided the infected
computer hadn't been rebooted. In August 2018 a WannaCry variant surfaced that
infected about 10,000 machines at Taiwan Semiconductor Manufacturing Company (TSMC)
plants and stopped several production lines — but there was no data leak there either.
The attack is linked to the Lazarus Group and, accordingly, to North Korean
state cyber operations — an attribution later confirmed by researchers at Google,
Kaspersky, Symantec and other companies.
Modern ransomware operators have learned from WannaCry's mistakes: they don't rely on
a single patchable exploit, they can spread on their own inside a network, and they
tie payment to a specific victim so that extortion actually works as a business model.
## What this means for businesses in Uzbekistan
The WannaCry story is first of all a story about unpatched systems and a lack of
visibility into what happens on endpoints. That's exactly why
[modern endpoint protection with EDR](/services/vulnerability) covers what none of the affected NHS
hospitals had: vulnerability and patch management in a single console, behavioral
analysis that spots suspicious activity before files get encrypted, and network-level
exploit protection. For a review of your own infrastructure and where a similar "hole"
might be, [request a demo](/contact) — it takes 15 minutes.