WannaCry ransomware attack - wikipedia WannaCry ransomware attack WannaCry Screenshot of the ransom note left on an infected system Date 12 May 2017 -- 15 May 2017 ( initial outbreak ) Location Worldwide Also known as Transformations : Wanna → Wana Cryptor → Crypt0r Cryptor → Decryptor Cryptor → Crypt → Cry Addition of `` 2.0 '' Short names : Wanna → WN → W Cry → CRY Type Cyberattack Theme Ransomware encrypting files with $300 -- $600 demand ( via bitcoin ) Cause WannaCry worm Outcome Over 200,000 victims and more than 300,000 computers infected The WannaCry ransomware attack was a May 2017 worldwide cyberattack by the WannaCry ransomware cryptoworm, which targeted computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in the Bitcoin cryptocurrency. The attack began on Friday, 12 May 2017, and within a day was reported to have infected more than 230,000 computers in over 150 countries. Parts of the United Kingdom 's National Health Service ( NHS ) were infected, causing it to run some services on an emergency - only basis during the attack, Spain 's Telefónica, FedEx and Deutsche Bahn were hit, along with many other countries and companies worldwide. Shortly after the attack began, Marcus Hutchins, a 22 - year - old web security researcher from North Devon in England then known as MalwareTech discovered an effective kill switch by registering a domain name he found in the code of the ransomware. This greatly slowed the spread of the infection, effectively halting the initial outbreak on Monday, 15 May 2017, but new versions have since been detected that lack the kill switch. Researchers have also found ways to recover data from infected machines under some circumstances. WannaCry propagates using EternalBlue, an exploit of Windows ' Server Message Block ( SMB ) protocol. Much of the attention and comment around the event was occasioned by the fact that the U.S. National Security Agency ( NSA ) had already discovered the vulnerability, but used it to create an exploit for its own offensive work, rather than report it to Microsoft. Microsoft eventually discovered the vulnerability, and on Tuesday, March 14, 2017, they issued security bulletin MS17 - 010, which detailed the flaw and announced that patches had been released for all Windows versions that were currently supported at that time, these being Windows 7, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2012, and Windows Server 2016, in addition to Windows Vista ( which had recently ended support ). However, many Windows users had not installed the patches when, two months later on May 12, 2017, WannaCry used the EternalBlue vulnerability to spread itself. The next day, Microsoft released emergency security patches for Windows 7 and Windows 8. Those still running older, unsupported versions of Microsoft Windows, such as Windows XP and Windows Server 2003, were initially at particular risk, but Microsoft released an emergency security patch for these platforms as well. Almost all victims of the cyberattack were running Windows 7, prompting a security researcher to argue that its effects on Windows XP users were `` insignificant '' in comparison. Within four days of the initial outbreak, security experts said that most organizations had applied updates, and that new infections had slowed to a trickle. Several organizations released detailed technical writeups of the malware, including Microsoft, Cisco, Malwarebytes, Symantec and McAfee. The `` payload '' works in the same fashion as most modern ransomware : it finds and encrypts a range of data files, then displays a `` ransom note '' informing the user and demanding a payment in bitcoin. It is considered a network worm because it also includes a `` transport '' mechanism to automatically spread itself. This transport code scans for vulnerable systems, then uses the EternalBlue exploit to gain access, and the DoublePulsar tool to install and execute a copy of itself. Contents 1 Description 2 `` Kill switch '' 3 EternalBlue 4 DoublePulsar 5 Attribution 6 Cyberattack 6.1 Ransomware analysis 6.2 Defensive response 6.3 Advice on ransom 6.4 Impact 7 EternalRocks 8 Reactions 9 Affected organizations 10 See also 11 Notes 12 References 13 External links Description The WannaCry ransomware attack was a May 2017 worldwide cyberattack by the WannaCry ransomware cryptoworm, which targeted computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in the Bitcoin cryptocurrency. `` Kill switch '' The software contained a URL that, when discovered by a security researcher, Marcus Hutchins, and the corresponding domain registered to track activity from infected machines, was found to act as a `` kill switch '' that shut down the software before it executed its payload, stopping the spread of the ransomware. The researcher speculated that this had been included in the software as a mechanism to prevent it being run on quarantined machines used by anti-virus researchers ; he observed that some sandbox environments will respond to all queries with traffic in order to trick the software into thinking that it is still connected to the internet, so the software attempts to contact an address which did not exist, to detect whether it was running in a sandbox, and do nothing if so. He also noted that it was not an unprecedented technique, having been observed in the Necurs trojan. On 19 May, it was reported that hackers were trying to use a Mirai botnet variant to effect a distributed attack on WannaCry 's kill - switch domain with the intention of knocking it offline. On 22 May, @ MalwareTechBlog protected the domain by switching to a cached version of the site, capable of dealing with much higher traffic loads than the live site. EternalBlue Main article : EternalBlue The network infection vector, EternalBlue, was released by the hacker group called The Shadow Brokers on 14 April 2017, along with other tools apparently leaked from Equation Group, which is widely believed to be part of the United States National Security Agency. EternalBlue exploits a vulnerability in Microsoft 's implementation of the Server Message Block ( SMB ) protocol. This Windows vulnerability was not a zero - day flaw, but one for which Microsoft had released a `` critical '' advisory, along with a security patch to fix the vulnerability two months before, on 14 March 2017. The patch was to the Server Message Block ( SMB ) protocol used by Windows, and fixed several versions of the Microsoft Windows operating system, including Windows Vista, Windows 7, Windows 8.1, and Windows 10, as well as server and embedded versions such as Windows Server 2008 onwards and Windows Embedded POSReady 2009 respectively, but not the older unsupported Windows XP, Windows Server 2003, and Windows 8 ( unsupported because Windows 8.1 is classified as a mandatory service pack upgrade ). The day after the WannaCry outbreak Microsoft released updates for these too. DoublePulsar Main article : DoublePulsar DoublePulsar is a backdoor tool, also released by The Shadow Brokers on 14 April 2017, Starting from 21 April 2017, security researchers reported that computers with the DoublePulsar backdoor installed were in the tens of thousands. By 25 April, reports estimated the number of infected computers to be up to several hundred thousands, with numbers increasing exponentially every day. The WannaCry code can take advantage of any existing DoublePulsar infection, or installs it itself. Attribution Linguistic analysis of the ransom notes indicated the authors were likely fluent in Chinese and proficient in English, as the versions of the notes in those languages were probably human - written while the rest seemed to be machine - translated. Cybersecurity companies Kaspersky Lab and Symantec have both said the code has some similarities with that previously used by the Lazarus Group ( believed to have carried out the cyberattack on Sony Pictures in 2014 and a Bangladesh bank heist in 2016 -- and linked to North Korea ). This could also be either simple re-use of code by another group or an attempt to shift blame -- as in a cyber false flag operation ; but a leaked internal NSA memo is alleged to have also linked the creation of the worm to North Korea. North Korea itself denies being responsible for the cyberattack. Cyberattack Map of the countries initially affected On 12 May 2017, WannaCry began affecting computers worldwide, with evidence pointing to an initial infection in Asia at 7 : 44am UTC. The initial infection was likely through an exposed vulnerable SMB port, rather than email phishing as initially assumed. When executed, the malware first checks the `` kill switch '' domain name ; if it is not found, then the ransomware encrypts the computer 's data, then attempts to exploit the SMB vulnerability to spread out to random computers on the Internet, and `` laterally '' to computers on the same network. As with other modern ransomware, the payload displays a message informing the user that files have been encrypted, and demands a payment of around $300 in bitcoin within three days, or $600 within seven days. Three hardcoded bitcoin addresses, or `` wallets '', are used to receive the payments of victims. As with all such wallets, their transactions and balances are publicly accessible even though the cryptocurrency wallet owners remain unknown. As of 14 June 2017, at 00 : 18 ET, a total of 327 payments totaling $130,634.77 ( 51.62396539 XBT ) had been transferred. Organizations that had not installed Microsoft 's security update were affected by the attack. Those still running the older Windows XP were at particularly high risk because no security patches had been released since April 2014 ( with the exception of one emergency patch released in May 2014 ). However, on the day after the outbreak, an emergency, out - of - band security update was released for XP and Windows Server 2003. A Kaspersky Labs study reported that less than 0.1 percent of the affected computers were running Windows XP, and that 98 percent of the affected computers were running Windows 7. In a controlled testing environment, the cybersecurity firm Kryptos Logic found that they were unable to infect a Windows XP system with WannaCry using just the exploits, as the payload failed to load, or caused the operating system to crash rather than actually execute and encrypt files. However, when executed manually, WannaCry could still operate on Windows XP. Ransomware analysis The process of virus execution can be divided into three steps : the main program file uses the vulnerability to spread itself, and run `` WannaCry '' ransom program ; `` WannaCry '' ransom program will encrypt the file ; the ransom interface ( @ WanaDecryptor @. exe ) displays the ransom information and decrypts the samples. Main program ( mssecsvc. exe ) file analysis : The sample main program is the main spread program of this event that is responsible for spreading itself and releasing the `` WannaCry '' ransom program, and then `` WannaCry '' encrypts user files and execute malicious behavior. `` WannaCry '' ransom program ( tasksche. exe ) analysis : The sample itself has an encrypted original RSA public key, and the attacker retains the decrypted RSA private key. Before encrypting the files, the CryptoAPI that calls Windows generates a new pair of RSA key, known as the sub-public key and sub-private key. And then, the sample encrypts the sub-private key with the original RSA public key and saves it as `` 00000000. eky '' and the sub-public key is saved as `` 00000000. pky ''. The sample generates an AES key for encrypting the file, the contents of the encrypted file are M2, and the AES key is encrypted with the sub-public key `` 00000000. pky ''. The contents of the encrypted file are M1. Then merge M1 and M2 and add file header `` WANACRY ! '' to save the encrypted file. When decrypting a file, the attacker decrypts the sub-private key `` 00000000. eky '' and saves the file as `` 00000000. dky '' for decrypting the file after receiving the decrypted file. The sample itself also has another pair of primary RSA public keys and private keys, which are used to decrypt the display files. Each encrypted file uses a different AES key. If you want to decrypt the file, you need to acquire the RSA sub-private key, decrypt the AES key of the file header, and then use the AES key to decrypt files. If there is no RSA sub-private key, the AES key can not be decrypted and the file can not be decrypted. Ransomware interface, decryption program ( @ WanaDecryptor @. exe ) analysis : `` @ WanaDecryptor @. exe '' is the ransomware interface program that displayed after sample has encrypted user data, which is responsible for displaying the Bitcoin wallet address and presenting part of the decrypted files. If wanting to decrypt all the files, you need to pay the `` ransom ''. For darknet ( Tor ), the majority of infected users show the three default Bitcoin wallet address, which makes a lot of people think that the attacker can not distinguish who paid the money and can not decrypt the file for specified users. Defensive Response Several hours after the initial release of the ransomware on 12 May 2017, while trying to establish the size of the attack, a researcher known by the name MalwareTech accidentally discovered what amounted to a `` kill switch '' hardcoded in the malware. Registering a domain name for a DNS sinkhole stopped the attack spreading as a worm, because the ransomware only encrypted the computer 's files if it was unable to connect to that domain, which all computers infected with WannaCry before the website 's registration had been unable to do. While this did not help already infected systems, it severely slowed the spread of the initial infection and gave time for defensive measures to be deployed worldwide, particularly in North America and Asia, which had not been attacked to the same extent as elsewhere. On 16 May 2017, researchers from University College London and Boston University reported that their PayBreak system could defeat WannaCry and several other families of ransomware. Within four days of the initial outbreak, security experts were saying that most organizations had applied updates, and that new infections had slowed to a trickle. It was discovered that Windows encryption APIs used by WannaCry may not completely clear the prime numbers used to generate the payload 's private keys from the memory, making it possible to potentially retrieve the required key if they had not yet been overwritten or cleared from resident memory. This behaviour was used by a French researcher to develop a tool known as WannaKey, which automates this process on Windows XP systems. This approach was iterated upon by a second tool known as Wanakiwi, which was tested to work on Windows 7 and Server 2008 R2 as well. The scale of the attack and subsequent exposure of vulnerabilities prompted Micosoft to release new security updates for older versions of Windows that are no longer supported, including for Windows XP, Windows Server 2003, Windows XP Embedded and Windows 7 Embedded. In a statement regarding the matter, the head of Microsoft 's Cyber Defense Operations Center, Adrienne Hall, said that `` Due to the elevated risk for destructive cyber-attacks at this time, we made the decision to take this action because applying these updates provides further protection against potential attacks with characteristics similar to WannaCrypt ( alternative name to WannaCry ) ''. Advice on ransom Experts advised against paying the ransom due to no reports of people getting their data back after payment and as high revenues would encourage more of such campaigns. Impact The ransomware campaign was unprecedented in scale according to Europol, which estimates that around 200,000 computers were infected across 150 countries. According to Kaspersky Lab, the four most affected countries were Russia, Ukraine, India and Taiwan. The attack affected many National Health Service hospitals in England and Scotland, and up to 70,000 devices -- including computers, MRI scanners, blood - storage refrigerators and theatre equipment -- may have been affected. On 12 May, some NHS services had to turn away non-critical emergencies, and some ambulances were diverted. In 2016, thousands of computers in 42 separate NHS trusts in England were reported to be still running Windows XP. NHS hospitals in Wales and Northern Ireland were unaffected by the attack. Nissan Motor Manufacturing UK in Tyne and Wear, England, halted production after the ransomware infected some of their systems. Renault also stopped production at several sites in an attempt to stop the spread of the ransomware. The attack 's impact is said to be relatively low compared to other potential attacks of the same type and could have been much worse had a security expert, who was independently researching the malware, not discovered that a kill - switch had been built in by its creators or if it had been specifically targeted on highly critical infrastructure, like nuclear power plants, dams or railway systems. According to Cyber risk modeling firm Cyence, economic losses from the cyber attack could reach up to $4 billion, with other groups estimating the losses to be in the hundreds of millions. EternalRocks Via a honeypot mechanism, Security researcher Miroslav Stampar detected a new malware named `` EternalRocks '' that uses seven leaked NSA hacking tools and leaves Windows machines vulnerable for future attacks that may occur at any time. When installed, the worm names itself WannaCry in attempt to evade security experts. Reactions A number of experts highlighted the NSA 's non-disclosure of the underlying vulnerability, and their loss of control over the EternalBlue attack tool that exploited it. Edward Snowden said that if the NSA had `` privately disclosed the flaw used to attack hospitals when they found it, not when they lost it, the attack may not have happened ''. British cybersecurity expert Graham Cluley also sees `` some culpability on the part of the U.S. intelligence services ''. According to him and others `` they could have done something ages ago to get this problem fixed, and they did n't do it ''. He also said that despite obvious uses for such tools to spy on people of interest, they have a duty to protect their countries ' citizens. Others have also commented that this attack shows that the practice of intelligence agencies to stockpile exploits for offensive purposes rather than disclosing them for defensive purposes may be problematic. Microsoft president and chief legal officer Brad Smith wrote, `` Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage. An equivalent scenario with conventional weapons would be the U.S. military having some of its Tomahawk missiles stolen. '' Russian President Vladimir Putin placed the responsibility of the attack on U.S. intelligence services, for having created EternalBlue. On 17 May, United States bipartisan lawmakers introduced the PATCH Act that aims to have exploits reviewed by an independent board to `` balance the need to disclose vulnerabilities with other national security interests while increasing transparency and accountability to maintain public trust in the process ''. The United States Congress will also hold a hearing on the attack on June 15. Two subpanels of the House Science Committee will hear the testimonies from various individuals working in the government and non-governmental sector about how the US can improve its protection mechanisms for its systems against similar attacks in the future. A cybersecurity researcher, working in loose collaboration with UK 's National Cyber Security Centre, researched the malware and discovered a `` kill switch ''. Later globally dispersed security researchers collaborated online to develop open source tools that allow for decryption without payment under some circumstances. Snowden states that when `` ( NSA ) - enabled ransomware eats the Internet, help comes from researchers, not spy agencies '' and asks why this is the case. Other experts also used the publicity around the attack as a chance to reiterate the value and importance of having good, regular and secure backups, good cybersecurity including isolating critical systems, using appropriate software, and having the latest security patches installed. Adam Segal, director of the digital and cyberspace policy program at the Council on Foreign Relations, stated that `` the patching and updating systems are broken, basically, in the private sector and in government agencies ''. In addition, Segal said that governments ' apparent inability to secure vulnerabilities `` opens a lot of questions about backdoors and access to encryption that the government argues it needs from the private sector for security ''. Arne Schönbohm, President of Germany 's Federal Office for Information Security ( BSI ), stated that `` the current attacks show how vulnerable our digital society is. It 's a wake - up call for companies to finally take IT security ( seriously ) ''. The effects of the attack also had political implications ; in the United Kingdom, the impact on the National Health Service quickly became political, with claims that the effects were exacerbated by Government underfunding of the NHS ; in particular, the NHS ceased its paid Custom Support arrangement to continue receiving support for unsupported Microsoft software used within the organization, including Windows XP. Home Secretary Amber Rudd refused to say whether patient data had been backed up, and Shadow Health Secretary Jon Ashworth accused Health Secretary Jeremy Hunt of refusing to act on a critical note from Microsoft, the National Cyber Security Centre ( NCSC ) and the National Crime Agency that had been received two months previously. Others argued that hardware and software vendors often fail to account for future security flaws, selling systems that − due to their technical design and market incentives − eventually wo n't be able to properly receive and apply patches. The NHS denied that it was still using XP, claiming only 4.7 % of devices within the organization ran Windows XP. Affected organizations The following is an alphabetical list of organisations confirmed to have been affected : Andhra Pradesh Police, India Aristotle University of Thessaloniki, Greece Automobile Dacia, Romania Cambrian College, Canada Chinese public security bureau CJ CGV Dalian Maritime University Deutsche Bahn Dharmais Hospital, Indonesia Faculty Hospital, Nitra, Slovakia FedEx Garena Blade and Soul Guilin University Of Aerospace Technology Guilin University Of Electronic Technology Harapan Kita Hospital, Indonesia Hezhou University Hitachi Honda Instituto Nacional de Salud, Colombia Lakeridge Health LAKS LATAM Airlines Group MegaFon Ministry of Internal Affairs of the Russian Federation Ministry of Foreign Affairs ( Romania ) National Health Service ( England ) NHS Scotland Nissan Motor Manufacturing UK O2, Germany Petrobrás PetroChina Portugal Telecom Pulse FM Q - Park Renault Russian Railways Sandvik São Paulo Court of Justice Saudi Telecom Company Sberbank Shandong University State Governments of India Government of Gujarat Government of Kerala Government of Maharashtra Government of West Bengal Suzhou Vehicle Administration Sun Yat - sen University, China Telefónica Telenor Hungary, Hungary Telkom ( South Africa ) Timrå Municipality, Sweden Universitas Jember, Indonesia University of Milano - Bicocca, Italy University of Montreal, Canada Vivo, Brazil See also 2016 Dyn cyberattack Computer security § Medical systems Conficker CryptoLocker Cyber self - defense Cyberweapon § Control and disarmament International Multilateral Partnership Against Cyber Threats Proactive cyber defence § Measures Security engineering Software versioning SQL Slammer Timeline of computer viruses and worms Vault 7 Windows Update 2017 Petya cyberattack Notes Jump up ^ The worm is also known as WannaCrypt, Wana Decrypt0r 2.0, WanaCrypt0r 2.0, and Wanna Decryptor. Jump up ^ The worm is also known as WannaCrypt, Wana Decrypt0r 2.0, WanaCrypt0r 2.0, and Wanna Decryptor. Jump up ^ iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com References Jump up ^ `` The WannaCry ransomware attack was temporarily halted. But it 's not over yet. ''. Jump up ^ `` Ransomware attack still looms in Australia as Government warns WannaCry threat not over ''. Australian Broadcasting Corporation. Retrieved 15 May 2017. Jump up ^ Cameron, Dell. `` Today 's Massive Ransomware Attack Was Mostly Preventable ; Here 's How To Avoid It ''. Gizmodo. Retrieved 13 May 2017. Jump up ^ `` Shadow Brokers threaten to release Windows 10 hacking tools ''. The Express Tribune. 31 May 2017. Retrieved 31 May 2017. ^ Jump up to : Brenner, Bill. `` WannaCry : the ransomware worm that did n't arrive on a phishing hook ''. Naked Security. Sophos. Retrieved 18 May 2017. ^ Jump up to : `` Cyber-attack : Europol says it was unprecedented in scale ''. BBC News. 13 May 2017. Retrieved 13 May 2017. Jump up ^ `` ' Unprecedented ' cyberattack hits 200,000 in at least 150 countries, and the threat is escalating ''. CNBC. 14 May 2017. Retrieved 16 May 2017. Jump up ^ Millar, Sheila A. ; Marshall, Tracy P. ; Cardon, Nathan A. ( 22 May 2017 ). `` WannaCry : Are Your Security Tools Up to Date ? ''. The National Law Review. Keller and Heckman LLP. Retrieved 9 July 2017. ^ Jump up to : Larson, Selena ( 12 May 2017 ). `` Massive ransomware attack hits 99 countries ''. CNN. Retrieved 12 May 2017. Jump up ^ `` The WannaCry ransomware attack has spread to 150 countries ''. The Verge. 14 May 2017. Retrieved 16 May 2017. Jump up ^ Hern, Alex ; Gibbs, Samuel ( 12 May 2017 ). `` What is ' WanaCrypt0r 2.0 ' ransomware and why is it attacking the NHS ? ''. The Guardian. London. ISSN 0261 - 3077. Retrieved 12 May 2017. Jump up ^ Daily Telegraph, 15 May 2017, IT expert who saved the world from ransomware virus is working with GCHQ to prevent repeat ( 1 ) Jump up ^ Khandelwal, Swati. `` It 's Not Over, WannaCry 2.0 Ransomware Just Arrived With No ' Kill - Switch ' ''. The Hacker News. Retrieved 14 May 2017. Jump up ^ Shieber, Jonathan. `` Companies, governments brace for a second round of cyberattacks in WannaCry 's wake ''. TechCrunch. Retrieved 14 May 2017. Jump up ^ Chan, Sewell ; Scott, Mark ( 14 May 2017 ). `` Cyberattack 's Impact Could Worsen in ' Second Wave ' of Ransomware ''. The New York Times. Retrieved 14 May 2017. Jump up ^ `` Warning : Blockbuster ' WannaCry ' malware could just be getting started ''. NBC News. Retrieved 14 May 2017. ^ Jump up to : `` Almost all WannaCry victims were running Windows 7 ''. The Verge. Vox Media. Retrieved 29 May 2017. Jump up ^ `` NHS cyber attack : Edward Snowden says NSA should have prevented cyber attack ''. The Independent. Retrieved 13 May 2017. Jump up ^ `` NHS cyber attack : Everything you need to know about ' biggest ransomware ' offensive in history ''. The Daily Telegraph. Retrieved 13 May 2017. Jump up ^ `` NSA - leaking Shadow Brokers just dumped its most damaging release yet ''. Ars Technica. Retrieved 15 April 2017. ^ Jump up to : `` Microsoft issues ' highly unusual ' Windows XP patch to prevent massive ransomware attack ''. The Verge. Vox Media. Retrieved 13 May 2017. ^ Jump up to : MSRC Team. `` Customer Guidance for WannaCrypt attacks ''. Microsoft. Retrieved 13 May 2017. ^ Jump up to : Volz, Dustin ( May 17, 2017 ). `` Cyber attack eases, hacking group threatens to sell code ''. Reuters. https://www.reuters.com. Retrieved 21 May 2017. Jump up ^ `` WannaCrypt ransomware worm targets out - of - date systems ''. TechNet. Microsoft. Retrieved 20 May 2017. ^ Jump up to : `` Player 3 Has Entered the Game : Say Hello to ' WannaCry ' ''. blog.talosintelligence.com. Retrieved 2017 - 05 - 16. ^ Jump up to : Clark, Zammis. `` The worm that spreads WanaCrypt0r ''. Malwarebytes Labs. malwarebytes.com. Retrieved 13 May 2017. ^ Jump up to : Samani, Raj. `` An Analysis of the WANNACRY Ransomware outbreak ''. McAfee. Retrieved 13 May 2017. ^ Jump up to : `` What you need to know about the WannaCry Ransomware ''. Symantec Security Response. Retrieved 14 May 2017. Jump up ^ Jakub Kroustek ( 12 May 2017 ). `` Avast reports on WanaCrypt0r 2.0 ransomware that infected NHS and Telefonica. ''. Avast Security News. Avast Software, Inc. Jump up ^ Fox - Brewster, Thomas. `` An NSA Cyber Weapon Might Be Behind A Massive Global Ransomware Outbreak ''. Forbes. Retrieved 12 May 2017. Jump up ^ Woollaston, Victoria. `` Wanna Decryptor : what is the ' atom bomb of ransomware ' behind the NHS attack ? ''. WIRED UK. Retrieved 13 May 2017. Jump up ^ `` WannaCry Infecting More Than 230,000 Computers in 99 Countries ''. Eyerys. 12 May 2017. ^ Jump up to : MalwareTech ( 13 May 2017 ). `` How to Accidentally Stop a Global Cyber Attacks ''. Jump up ^ Greenberg, Andy. `` Botnets Are Trying to Reignite the Ransomware Outbreak ''. WIRED. Retrieved 22 May 2017. Jump up ^ Gibbs, Samuel ( 22 May 2017 ). `` WannaCry hackers still trying to revive attack says accidental hero ''. The Guardian. Retrieved 22 May 2017. Jump up ^ Fox - Brewster, Thomas ( 16 February 2015 ). `` Equation = NSA ? Researchers Uncloak Huge ' American Cyber Arsenal ' ''. Forbes. Retrieved 24 November 2015. Jump up ^ `` Latest Shadow Brokers dump -- owning SWIFT Alliance Access, Cisco and Windows ''. Medium. 14 April 2017. Retrieved 15 April 2017. Jump up ^ `` The legacy code behind WannaCry -- the skeleton in the closet ''. scademy.com/blog/. Retrieved 18 April 2017. ^ Jump up to : `` Microsoft Security Bulletin MS17 - 010 -- Critical ''. TechNet. Microsoft. Retrieved 13 May 2017. ^ Jump up to : `` WannaCry Ransomware Attack Hits Victims With Microsoft SMB Exploit ''. eWeek. Retrieved 13 May 2017. ^ Jump up to : `` WannaCry : BSI ruft Betroffene auf, Infektionen zu melden '' ( in German ). heise online. Retrieved 14 May 2017. Jump up ^ Goodin, Dan. `` 10,000 Windows computers may be infected by advanced NSA backdoor ''. ARS Technica. Retrieved 14 May 2017. Jump up ^ Goodin, Dan. `` NSA backdoor detected on > 55,000 Windows boxes can now be remotely removed ''. ARS Technica. Retrieved 14 May 2017. Jump up ^ Broersma, Matthew. `` NSA Malware ' Infects Nearly 200,000 Systems ' ''. Silicon. Retrieved 14 May 2017. Jump up ^ Cameron, Dell ( 13 May 2017 ). `` Today 's Massive Ransomware Attack Was Mostly Preventable ; Here 's How To Avoid It ''. Gizmodo. Retrieved 15 May 2017. Jump up ^ `` How One Simple Trick Just Put Out That Huge Ransomware Fire ''. Forbes. 24 April 2017. Retrieved 15 May 2017. Jump up ^ Leyden, John ( 26 May 2017 ). `` WannaCrypt ransomware note likely written by Google Translate - using Chinese speakers ''. The Register. Retrieved 26 May 2017. Jump up ^ Condra, Jon ; Costello, John ; Chu, Sherman ( May 25, 2017 ). `` Linguistic Analysis of WannaCry Ransomware Messages Suggests Chinese - Speaking Authors ''. Flashpoint. Archived from the original on May 27, 2017. Flashpoint assesses with high confidence that the author ( s ) of WannaCry 's ransomware notes are fluent in Chinese, as the language used is consistent with that of Southern China, Hong Kong, Taiwan, or Singapore. Flashpoint also assesses with high confidence that the author ( s ) are familiar with the English language, though not native. (... ) Flashpoint assesses with moderate confidence that the Chinese ransom note served as the original source for the English version, which then generated machine translated versions of the other notes. The Chinese version contains content not in any of the others, though no other notes contain content not in the Chinese. The relative familiarity found in the Chinese text compared to the others suggests the authors were fluent in the language -- perhaps comfortable enough to use the language to write the initial note. ^ Jump up to : Solong, Olivia ( 15 May 2017 ). `` WannaCry ransomware has links to North Korea, cybersecurity experts say ''. The Guardian. Jump up ^ `` Experts question North Korea role in WannaCry cyberattack ''. The New Zealand Herald. AP. May 21, 2017. Retrieved 22 May 2017. Jump up ^ Nakashima, Ellen. `` The NSA has linked the WannaCry computer worm to North Korea ''. The Washington Post. The Washington Post. Retrieved 15 June 2017. Jump up ^ `` North Korea says linking cyber attacks to Pyongyang is ' ridiculous ' ''. Reuters. 19 May 2017. Retrieved 21 May 2017. Jump up ^ `` Experts Question North Korea Role in WannaCry Cyberattack ''. The New York Times. 19 May 2017. Retrieved 21 May 2017. Jump up ^ `` Cyber-attack : Europol says it was unprecedented in scale ''. BBC. 13 May 2017. Jump up ^ Newman, Lily Hay. `` The Ransomware Meltdown Experts Warned About Is Here ''. Wired. Retrieved 13 May 2017. Jump up ^ Yuzifovich, Yuriy. `` WannaCry : views from the DNS frontline ''. Security and Data Science. nominum. Retrieved 18 May 2017. Jump up ^ Goodin, Dan. `` An NSA - derived ransomware worm is shutting down computers worldwide ''. ARS Technica. Retrieved 14 May 2017. Jump up ^ `` Russian - linked cyber gang blamed for NHS computer hack using bug stolen from US spy agency ''. The Telegraph. Retrieved 12 May 2017. Jump up ^ Bilefsky, Dan ; Perlroth, Nicole ( 12 May 2017 ). `` Hackers Hit Dozens of Countries Exploiting Stolen N.S.A. Tool ''. The New York Times. ISSN 0362 - 4331. Retrieved 12 May 2017. Jump up ^ Thomas, Andrea ; Grove, Thomas ; Gross, Jenny ( 13 May 2017 ). `` More Cyberattack Victims Emerge as Agencies Search for Clues ''. The Wall Street Journal. ISSN 0099 - 9660. Retrieved 14 May 2017. Jump up ^ Collins, Keith. `` Watch as these bitcoin wallets receive ransomware payments from the global cyberattack ''. Quartz. Retrieved 14 May 2017. Jump up ^ `` @ actual_ransom tweets ''. Twitter. Retrieved 19 May 2017. ^ Jump up to : `` NHS Hospitals Are Running Thousands of Computers on Unsupported Windows XP ''. Motherboard. Retrieved 13 May 2017. ^ Jump up to : `` Windows XP computers were mostly immune to WannaCry ''. The Verge. Retrieved 30 May 2017. Jump up ^ `` WannaCry : Two Weeks and 16 Million Averted Ransoms Later ''. Kryptos Logic. Retrieved 30 May 2017. Jump up ^ Antiy, CERT. `` IN - DEPTH ANALYSIS REPORT ON WANNACRY RANSOMWARE ''. Antiy.net. Retrieved 3 July 2017. Jump up ^ `` ' Just doing my bit ' : The 22yo who blocked the WannaCry cyberattack ''. ABC News. 2017 - 05 - 16. Retrieved 2017 - 05 - 17. Jump up ^ `` Government under pressure after NHS crippled in global cyber attack as weekend of chaos looms ''. The Telegraph. 12 May 2017. Jump up ^ Thomson, Iain ( 13 May 2017 ). `` 74 countries hit by NSA - powered WannaCrypt ransomware backdoor : Emergency fixes emitted by Microsoft for WinXP + ''. The Register. Jump up ^ Khomami, Nadia ; Solon, Olivia ( 13 May 2017 ). `` ' Accidental hero ' halts ransomware attack and warns : this is not over ''. The Guardian. Jump up ^ Newman, Lily Hay. `` How an Accidental ' Kill Switch ' Slowed Friday 's Massive Ransomware Attack ''. Wired Security. Retrieved 14 May 2017. Jump up ^ Solon, Olivia ( 13 May 2017 ). `` ' Accidental hero ' finds kill switch to stop spread of ransomware cyber-attack ''. The Guardian. London. Retrieved 13 May 2017. Jump up ^ Foxx, Chris ( 13 May 2017 ). `` Global cyber-attack : Security blogger halts ransomware ' by accident ' ''. BBC. Retrieved 13 May 2017. Jump up ^ Kan, Micael. `` A ' kill switch ' is slowing the spread of WannaCry ransomware ''. PC World. Retrieved 13 May 2017. Jump up ^ `` Protection from Ransomware like WannaCry ''. College of Engineering. Boston University. Retrieved 2017 - 05 - 19. Jump up ^ Kolodenker, Eugene ( 2017 - 05 - 16 ). `` PayBreak able to defeat WannaCry / WannaCryptor ransomware ''. Information Security Research & Education. Bentham 's Gaze. University College London. Retrieved 2017 - 05 - 19. Jump up ^ `` Windows XP hit by WannaCry ransomware ? This tool could decrypt your infected files ''. ZDNet. Retrieved 30 May 2017. Jump up ^ `` Windows XP PCs infected by WannaCry can be decrypted without paying ransom ''. Ars Technica. Retrieved 30 May 2017. Jump up ^ Greenberg, Andy ( 18 May 2017 ). `` A WannaCry flaw could help some windows XP users get files back ''. Wired. Jump up ^ `` More people infected by recent WCry worm can unlock PCs without paying ransom ''. Ars Technica. Retrieved 30 May 2017. Jump up ^ `` Microsoft rushes out patch for Windows XP to prevent another WannaCry attack via a Shadow Brokers release ''. Computing.com. 2017 - 06 - 14. ISSN 0261 - 3077. Retrieved 2017 - 06 - 14. Jump up ^ Hern, Alex ( 2017 - 06 - 14 ). `` WannaCry attacks prompt Microsoft to release Windows updates for older versions ''. The Guardian. ISSN 0261 - 3077. Retrieved 2017 - 06 - 14. Jump up ^ `` Ransomware attack hits 200,000 computers across the globe ''. New Scientist. May 17, 2017. Jump up ^ Baraniuk, Chris ( 15 May 2017 ). `` Should you pay the WannaCry ransom ? ''. BBC. Jump up ^ Palmer, Danny. `` Ransomware : WannaCry was basic, next time could be much worse ZDNet ''. ZDNet. Retrieved 22 May 2017. Jump up ^ Jones, Sam ( 14 May 2017 ). `` Global alert to prepare for fresh cyber attacks ''. Financial Times. access - date = requires url = ( help ) Jump up ^ `` Global cyberattack strikes dozens of countries, cripples U.K. hospitals ''. CBS News. Retrieved 13 May 2017. Jump up ^ Ungoed - Thomas, Jon ; Henry, Robin ; Gadher, Dipesh ( 14 May 2017 ). `` Cyber-attack guides promoted on YouTube ''. The Sunday Times. Retrieved 14 May 2017. ^ Jump up to : `` NHS cyber-attack : GPs and hospitals hit by ransomware ''. BBC News. 12 May 2017. Retrieved 12 May 2017. Jump up ^ Wong, Julia Carrie ; Solon, Olivia ( 12 May 2017 ). `` Massive ransomware cyber-attack hits 74 countries around the world ''. The Guardian. London. Retrieved 12 May 2017. ^ Jump up to : Marsh, Sarah ( 12 May 2017 ). `` The NHS trusts hit by malware -- full list ''. The Guardian. London. Retrieved 12 May 2017. Jump up ^ Sharman, Jon ( 13 May 2017 ). `` Cyber-attack that crippled NHS systems hits Nissan car factory in Sunderland and Renault in France ''. The Independent. Retrieved 13 May 2017. Jump up ^ Rosemain, Mathieu ; Le Guernigou, Yann ; Davey, James ( 13 May 2017 ). `` Renault stops production at several plants after ransomware cyber attack as Nissan also hacked ''. Daily Mirror. Retrieved 13 May 2017. Jump up ^ `` Lucky break slows global cyberattack ; what 's coming could be worse ''. Chicago Tribune. Retrieved 14 May 2017. ^ Jump up to : Helmore, Edward ( 13 May 2017 ). `` Ransomware attack reveals breakdown in US intelligence protocols, expert says ''. The Guardian. Retrieved 14 May 2017. Jump up ^ `` The Latest : Researcher who helped halt cyberattack applauded ''. Star Tribune. Retrieved 14 May 2017. Jump up ^ `` Global ' WannaCry ' ransomware cyberattack seeks cash for data ''. Washington Post. Retrieved 16 May 2017. Jump up ^ `` '' WannaCry '' ransomware attack losses could reach $4 billion ``. Retrieved 2017 - 06 - 14. Jump up ^ Leyden, John ( 17 May 2017 ). `` 7 NSA hack tool wielding follow - up worm oozes onto scene : Hello, no need for any phish ! ''. Retrieved 22 May 2017. Jump up ^ `` EternalRocks worm uses seven NSA exploits ( WannaCry used two ) ''. CNET. Retrieved 23 May 2017. Jump up ^ `` New SMB Worm Uses Seven NSA Hacking Tools. WannaCry Used Just Two ''. BleepingComputer. Retrieved 22 May 2017. Jump up ^ Verma, Adarsh ( 23 May 2017 ). `` EternalRocks : New Malware Uses 7 NSA Hacking Tools, WannaCry Used Just 2 ''. Fossbytes. Retrieved 22 May 2017. Jump up ^ Wong, Julia Carrie ; Solon, Olivia ( 12 May 2017 ). `` Massive ransomware cyber-attack hits 74 countries around the world ''. The Guardian. Retrieved 12 May 2017. Jump up ^ Heintz, Sylvia Hui, Allen G. Breed and Jim. `` Lucky break slows global cyberattack ; what 's coming could be worse ''. Chicago Tribune. Retrieved 14 May 2017. Jump up ^ `` Ransomware attack ' like having a Tomahawk missile stolen ', says Microsoft boss ''. The Guardian. 14 May 2017. Retrieved 15 May 2017. Jump up ^ Storm, Darlene ( 2017 - 05 - 15 ). `` WikiLeaks posts user guides for CIA malware implants Assassin and AfterMidnight ''. Computerworld. Retrieved 2017 - 05 - 17. Jump up ^ Smith, Brad. `` The need for urgent collective action to keep people safe online ''. Microsoft. Retrieved 14 May 2017. ^ Jump up to : Vidal Liy, Macarena ( 15 May 2017 ). `` Putin culpa a los servicios secretos de EE UU por el virus ' WannaCry ' que desencadenó el ciberataque mundial '' ( in Spanish ). El País. Retrieved 16 May 2017. Jump up ^ `` Patch Act bill before Congress ''. Retrieved 23 May 2017. Jump up ^ Whittaker, Zack. `` Congress introduces bill to stop US from stockpiling cyber-weapons ''. ZDNet. Retrieved 23 May 2017. ^ Jump up to : Chalfant, Morgan ( 2017 - 06 - 12 ). `` Lawmakers to hold hearing on ' Wanna Cry ' ransomware attack ''. TheHill. Retrieved 2017 - 06 - 14. Jump up ^ `` Finding the kill switch to stop the spread of ransomware -- NCSC Site ''. www.ncsc.gov.uk. Retrieved 21 May 2017. ^ Jump up to : `` Sky Views : Stop the cyberattack blame game ''. Sky News. Retrieved 21 May 2017. Jump up ^ `` gentilkiwi / wanakiwi ''. GitHub. Retrieved 20 May 2017. Jump up ^ `` aguinet / wannakey ''. GitHub. Retrieved 20 May 2017. Jump up ^ Auchard, Eric ( 19 May 2017 ). `` French researchers find way to unlock WannaCry without ransom ''. Reuters. Retrieved 19 May 2017. Jump up ^ Snowden, Edward ( @ Snowden ) ( 13 May 2017 ). `` When @ NSAGov - enabled ransomware eats the internet, help comes from researchers, not spy agencies. Amazing story. '' ( Tweet ). Retrieved 20 May 2017 -- via Twitter. Jump up ^ Snowden, Edward ( @ Snowden ) ( 13 May 2017 ). `` Pause a moment to consider why we 're left with researchers, not governments, trying to counter the @ NSAGov - enabled ransomware mess. Hint : '' ( Tweet ). Retrieved 20 May 2017 -- via Twitter. Jump up ^ Coughlin, Tom. `` WannaCry Ransomware Demonstrations The Value of Better Security and Backups ''. Forbes. Retrieved 14 May 2017. Jump up ^ `` The ransomware attack is all about the insufficient funding of the NHS ''. The Guardian. 13 May 2017. Retrieved 14 May 2017. Jump up ^ `` Jeremy Hunt ' ignored warning signs ' before cyber-attack hit NHS ''. The Guardian. 13 May 2017. Retrieved 14 May 2017. Jump up ^ Larson, Selena ( May 17, 2017 ). `` Why WannaCry ransomware took down so many businesses ''. CNN Money. CNN. Retrieved 22 May 2017. Jump up ^ `` UPDATED Statement on reported NHS cyber-attack ( 13 May ) ''. National Health Service. Retrieved 30 May 2017. Jump up ^ `` Andhra police computers hit by cyberattack ''. The Times of India. 13 May 2017. Retrieved 13 May 2017. Jump up ^ `` '' Χάκαραν '' και το ΑΠΘ στην παγκόσμια κυβερνοεπίθεση ! ``. Proto Thema ( in Greek ). 13 May 2017. Retrieved 18 May 2017. Jump up ^ `` Atacul cibernetic global a afectat și Uzina Dacia de la Mioveni. Renault a anunțat că a oprit producția și în Franța ''. Pro TV ( in Romanian ). 13 May 2017. Jump up ^ `` Hackers demand $54 K in Cambrian College ransomware attack ''. CBC.ca. Retrieved 16 May 2017. ^ Jump up to : Mimi Lau ( 14 May 2017 ). `` Chinese police and petrol stations hit by ransomware attack ''. South China Morning Post. Retrieved 15 May 2017. Jump up ^ `` Korean gov 't computers safe from WannaCry attack ''. The Korea Herald. Retrieved 15 May 2017. ^ Jump up to : `` 一夜 之 间 勒索 病毒 '' 永恒 之 蓝 `` 席卷 国内 近 3 万 机构 被 攻陷 全球 超 十 万 台 电脑 '' 中毒 `` 江苏 等 十 省 市 受害 最 严重 ''. Jump up ^ `` Weltweite Cyberattacke trifft Computer der Deutschen Bahn ''. Frankfurter Allgemeine Zeitung ( in German ). 13 May 2017. Retrieved 13 May 2017. ^ Jump up to : `` Global cyber attack : A look at some prominent victims '' ( in Spanish ). elperiodico.com. 13 May 2017. Retrieved 14 May 2017. Jump up ^ `` Hackerský útok zasiahol aj Fakultnú nemocnicu v Nitre ''. etrend.sk ( in Slovak ). 15 May 2017. Retrieved 15 May 2017. Jump up ^ `` What is Wannacry and how can it be stopped ? ''. Financial Times. 12 May 2017. Retrieved 13 May 2017. Jump up ^ `` เซิร์ฟเวอร์ เกม Blade & Soul ของ Garena ประเทศไทย ถูก WannaCrypt โจมตี '' ( in Thai ). blognone.com. 13 May 2017. Retrieved 14 May 2017. Jump up ^ `` 日立 、 社内 システム の 一 部 に 障害 サイバー 攻撃 の 影響 か ''. 日本 経済 新聞 ( in Japanese ). 15 May 2017. Retrieved 21 June 2017. Jump up ^ `` Honda halts Japan car plant after WannaCry virus hits computer network ''. Reuters. 21 June 2017. Retrieved 21 June 2017. Jump up ^ `` Instituto Nacional de Salud, entre víctimas de ciberataque mundial ''. El Tiempo ( in Spanish ). 13 May 2017. Jump up ^ `` Ontario health ministry on high alert amid global cyberattack ''. Toronto Star. Jump up ^ `` Laks second Dutc victom of WannaCry ''. Nu.nl. Jump up ^ `` LATAM Airlines también está alerta por ataque informático ''. Fayerwayer. Retrieved 13 May 2017. Jump up ^ `` Massive cyber attack creates chaos around the world ''. news.com.au. Retrieved 13 May 2017. Jump up ^ `` Researcher ' accidentally ' stops spread of unprecedented global cyberattack ''. ABC News. Retrieved 13 May 2017. Jump up ^ `` UPDATE. Atac cibernetic la MAE. Cine sunt hackerii de elită care au falsificat o adresă NATO ''. Libertatea ( in Romanian ). 12 May 2017. ^ Jump up to : `` Cyber-attack that crippled NHS systems hits Nissan car factory in Sunderland and Renault in France ''. The Independent. 13 May 2017. Retrieved 13 May 2017. Jump up ^ `` Nach Attacke mit Trojaner WannaCry : Kundensystem bei O2 ausgefallen '' ( in German ). FOCUS Online. Retrieved 20 May 2017. Jump up ^ `` Erhebliche Störungen -- WannaCry : Kundendienst von O2 ausgefallen -- HAZ -- Hannoversche Allgemeine '' ( in German ). Hannoversche Allgemeine Zeitung. Retrieved 20 May 2017. ^ Jump up to : `` WannaCry no Brasil e no mundo ''. O Povo ( in Portuguese ). 13 May 2017. Retrieved 13 May 2017. Jump up ^ `` PT Portugal alvo de ataque informático internacional ''. Observador ( in Portuguese ). 12 May 2017. Retrieved 13 May 2017. Jump up ^ `` Ransomware infects narrowcast radio station ''. RadioInfo. 15 May 2017. Retrieved 30 September 2017. Jump up ^ `` Parkeerbedrijf Q - Park getroffen door ransomware - aanval ''. Nu.nl ( in Dutch ). 13 May 2017. Retrieved 14 May 2017. Jump up ^ `` France 's Renault hit in worldwide ' ransomware ' cyber attack '' ( in Spanish ). France 24. 13 May 2017. Retrieved 13 May 2017. Jump up ^ `` Компьютеры РЖД подверглись хакерской атаке и заражены вирусом ''. Radio Free Europe / Radio Liberty. Retrieved 13 May 2017. Jump up ^ Amjad Shacker ( @ AmjadShacker ) ( 14 May 2017 ). `` - '' ( ⁥ ⁥ screenshot of message ) ( Tweet ) ( in Arabic ) -- via Twitter. ^ Jump up to : `` Ransomware WannaCry Surfaces In Kerala, Bengal : 10 Facts ''. New Delhi Television Limited ( NDTV ). Retrieved 15 May 2017. Jump up ^ Sanjana Nambiar ( 16 May 2017 ). `` Hit by WannaCry ransomware, civic body in Mumbai suburb to take 3 more days to fix computers ''. Hindustan Times. Retrieved 17 May 2017. Jump up ^ `` Un ataque informático masivo con ' ransomware ' afecta a medio mundo '' ( in Spanish ). elperiodico.com. 12 May 2017. Retrieved 13 May 2017. Jump up ^ Balogh, Csaba ( 12 May 2017 ). `` Ideért a baj : Magyarországra is elért az óriási kibertámadás ''. HVG ( in Hungarian ). Retrieved 13 May 2017. Jump up ^ `` Telkom systems crippled by WannaCry ransomware ''. MyBroadband. 21 May 2017. Retrieved 21 May 2017. Jump up ^ `` Timrå kommun drabbat av utpressningsattack '' ( in Swedish ). Sveriges Television. 13 May 2017. Retrieved 15 May 2017. Jump up ^ `` Virus Ransomware Wannacry Serang Perpustakaan Universitas Jember ''. Tempo ( in Indonesian ). 16 May 2017. Retrieved 17 May 2017. Jump up ^ `` Il virus Wannacry arrivato a Milano : colpiti computer dell'università Bicocca ''. la Repubblica ( in Italian ). 12 May 2017. Retrieved 13 May 2017. Jump up ^ `` Some University of Montreal computers hit with WannaCry virus ''. The Globe and Mail. May 16, 2017. Retrieved 16 May 2017. External links Wikimedia Commons has media related to WannaCry ransomware attack. Ransom : Win32 / WannaCrypt at Microsoft Malware Protection Center @ actual_ransom on Twitter, a Twitterbot tracking the ransom payments Inside the digital heist that terrorized the world -- and only made $100 k Hacking in the 2010s ← 2000s Timeline 2020s → Major incidents Operation Aurora Australian cyberattacks Operation Payback 2011 HBGary Federal DigiNotar RSA SecurID compromise Operation Tunisia 2011 PlayStation Network outage Operation AntiSec 2012 Stratfor email leak LinkedIn hack 2013 South Korea cyberattack Snapchat hack 2013 Yahoo ! data breach 2014 Anthem medical data breach Operation Tovar iCloud leaks of celebrity photos Sony Pictures hack Russian hacker password theft 2014 Yahoo ! data breach 2015 Office of Personnel Management data breach Hacking Team Ashley Madison data breach VTech data breach SWIFT banking hack 2016 Bangladesh Bank robbery Hollywood Presbyterian Medical Center ransomware incident Commission on Elections data breach Democratic National Committee cyber attacks DCCC cyber attacks Dyn cyberattack Russian interference in U.S. election 2017 WannaCry ransomware attack Westminster cyberattack Petya cyberattack 2017 cyberattacks on Ukraine Equifax data breach Groups Anonymous associated events Bureau 121 Cozy Bear CyberBerkut Derp Equation Group Fancy Bear GNAA Goatse Security Guccifer 2.0 Hacking Team Iranian Cyber Army Lizard Squad LulzRaft LulzSec New World Hackers NullCrew NSO Group PayPal 14 PLA Unit 61398 PLATINUM Pranknet RedHack Rocket Kitten The Shadow Brokers Syrian Electronic Army TeaMp0isoN Tailored Access Operations UGNazi Yemen Cyber Army Individuals George Hotz Guccifer Hector Monsegur Jeremy Hammond Junaid Hussain Kristoffer von Hassel Mustafa Al - Bassam MLT Ryan Ackroyd Topiary The Jester weev Vulnerabilities discovered Evercookie ( 2010 ) iSeeYou ( 2013 ) Heartbleed ( 2014 ) Shellshock ( 2014 ) POODLE ( 2014 ) Rootpipe ( 2014 ) Row hammer ( 2014 ) JASBUG ( 2015 ) Stagefright ( 2015 ) DROWN ( 2016 ) Badlock ( 2016 ) Dirty COW ( 2016 ) Cloudbleed ( 2017 ) Broadcom Wi - Fi ( 2017 ) EternalBlue ( 2017 ) DoublePulsar ( 2017 ) Silent Bob is Silent ( 2017 ) Malware Careto / The Mask CryptoLocker Dexter Duqu Duqu 2.0 FinFisher Flame Gameover ZeuS Mahdi Metulji botnet Mirai NSA ANT catalog Pegasus R2D2 Shamoon Stars virus Stuxnet Vault 7 WannaCry X-Agent 2010s portal Computer security portal Criminal justice portal Law portal Information technology portal Internet portal Jump up ^ http://www.antiy.net/p/in-depth-analysis-report-on-wannacry-ransomware/ Retrieved from `` https://en.wikipedia.org/w/index.php?title=WannaCry_ransomware_attack&oldid=803900441 '' Categories : 2017 in computer science Cyberattacks Cybercrime Hacking in the 2010s May 2017 crimes Ransomware Hidden categories : CS1 German - language sources ( de ) Pages using citations with accessdate and no URL CS1 Spanish - language sources ( es ) CS1 Greek - language sources ( el ) CS1 Romanian - language sources ( ro ) CS1 Slovak - language sources ( sk ) CS1 Thai - language sources ( th ) CS1 Japanese - language sources ( ja ) CS1 Portuguese - language sources ( pt ) CS1 Dutch - language sources ( nl ) CS1 Arabic - language sources ( ar ) CS1 Hungarian - language sources ( hu ) CS1 Swedish - language sources ( sv ) CS1 Indonesian - language sources ( id ) CS1 Italian - language sources ( it ) Use dmy dates from May 2017 Interlanguage link template existing link All articles with links needing disambiguation Articles with links needing disambiguation from June 2017 Twitter username same as Wikidata Talk Contents About Wikipedia Afrikaans भोजपुरी Български Bosanski Català Čeština Dansk Deutsch Eesti Ελληνικά Español Euskara فارسی Français 한국어 Հայերեն हिन्दी Bahasa Indonesia Italiano עברית Lietuvių Lumbaart Magyar മലയാളം Bahasa Melayu မြန်မာဘာသာ Nederlands 日本 語 ਪੰਜਾਬੀ Polski Português Română Русский Slovenčina Српски / srpski Srpskohrvatski / српскохрватски Suomi Svenska தமிழ் ไทย Тоҷикӣ Türkçe Українська Tiếng Việt 粵語 中文 Edit links This page was last edited on 5 October 2017, at 11 : 33. Text is available under the Creative Commons Attribution - ShareAlike License ; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia ® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization. About Wikipedia

Question: which major u.s. company was attacked by the wannacry randsomware
Answer: Microsoft