The WannaCry ransomware attack is an ongoing cyberattack of the WannaCry (or WannaCrypt,[3] WanaCrypt0r 2.0,[4][5] Wanna Decryptor[6]) ransomware computer worm targeting the Microsoft Windows operating system. The attack started on Friday, 12 May 2017, infecting more than 230,000 computers in 150 countries, with the software demanding ransom payments in the cryptocurrency bitcoin in 28 languages.[7] The attack has been described by Europol as unprecedented in scale.[8]
The attack affected Telefónica and several other large companies in Spain, as well as parts of Britain's National Health Service (NHS),[9] FedEx, Deutsche Bahn, and LATAM Airlines.[10][11][12][13] Other targets in at least 99 countries were also reported to have been attacked around the same time.[14][15]
Most previous ransomware arrives by phishing emails, and this is also suspected to be the case with WannaCry,[16] but once installed it also uses the EternalBlue exploit and DoublePulsar backdoor developed by the U.S. National Security Agency (NSA)[17][18] to spread through a network which has not installed recent security updates to directly infect any exposed systems.[5][19] A "critical" patch had been issued by Microsoft on 14 March 2017 to remove the underlying vulnerability for supported systems, nearly two months before the attack,[20] but many organizations had not yet applied it.[21]
Those still running exposed older, unsupported operating systems were initially at particular risk, such as Windows XP and Windows Server 2003, but Microsoft has now taken the unusual step of releasing updates for these operating systems for all customers.[3][22]
Shortly after the attack began, a web security researcher who blogs as "MalwareTech" accidentally found an effective kill switch, registering a website that was mentioned in the code of the ransomware. This slowed the spread of infection, but new versions have now been detected that lack the kill switch
Background
The purported infection vector, EternalBlue, was released by the hacker group The Shadow Brokers on 14 April 2017,[28] along with other tools apparently leaked from Equation Group, believed to be part of the United States National Security Agency.[29][30]
EternalBlue exploits vulnerability MS17-010[20] in Microsoft's implementation of the Server Message Block (SMB) protocol. This Windows vulnerability is not a zero-day flaw, but one for which Microsoft had had released a "Critical" advisory, along with a security patch to fix the vulnerability two months before, on 14 March 2017.[20] The patch was to the Server Message Block (SMB) protocol used by Windows,[31][32] and fixed several client versions of the Microsoft Windows operating system, including Windows Vista onwards (with the exception of Windows 8), as well as server and embedded versions such as Windows Server 2008 onwards and Windows Embedded POSReady 2009 respectively, but not the older Windows XP, according to Microsoft.[20] According to Dona Sarkar, head of the Windows Insider Program at Microsoft, Windows 10 was not affected;[33] however, IT writer Woody Leonhard questioned if this is the case with all Windows 10 systems, or just builds 14393.953 and later.[34]
Starting from 21 April 2017, security researchers started reporting that computers with the DoublePulsar backdoor installed were in the tens of thousands.[35] By 25 April, reports estimated the number of infected computers to be up to several hundred thousands, with numbers increasing exponentially every day.[36][37] Apparently DoublePulsar was used alongside EternalBlue in the attack.[38][39]
Attack
Countries initially affected[40]
On 12 May 2017, WannaCry began affecting computers worldwide.[41] The initial infection might have been either through a vulnerability in the network defenses or a very well-crafted spear phishing attack.[42] When executed, the malware first checks the "kill switch" domain name.[a] If it is not found, then the ransomware encrypts the computer's data,[43][44][45] then attempts to exploit the SMB vulnerability to spread out to random computers on the Internet,[46] and "laterally" to computers on the same network.[47] As with other modern ransomware, the payload displays a message informing the user that files have been encrypted, and demands a payment of around $300 in bitcoin within three days or $600 within seven days.[44][48]
Organizations that had not installed Microsoft's security update were affected by the attack.[31] Those still running the older Windows XP[49] were at particularly high risk because no security patches had been released since April 2014 (with the exception of one emergency patch released in May 2014).[3][50] However, the day after the outbreak Microsoft released an emergency security patch for Windows XP.[3]
According to Wired, affected systems will also have had the DoublePulsar backdoor installed; this will also need to be removed when systems are decrypted.[6]
Ken Collins of Quartz wrote on 12 May that three or more hardcoded bitcoin addresses, or "wallets", are used to receive the payments of victims. As with all such wallets, their transactions and balances are publicly accessible even though the wallet owners remain unknown. To track the ransom payments in real time, a Twitterbot that watches each of the three wallets has been set up.[51] As of 15 May 2017 at 7 PM, a total of 220 payments totaling $59,747.53 had been transferred.[52][53][54]
Variants
On 14 May, two additional variants were detected. One of these variants had a new kill switch which was quickly registered, while the other had no kill switch but had a corrupted payload preventing encryption of files.[55]
Impact
The ransomware campaign was unprecedented in scale according to Europol.[8] The attack affected many National Health Service hospitals in England and Scotland,[56] and up to 70,000 devices – including computers, MRI scanners, blood-storage refrigerators and theatre equipment – may have been affected.[57] On 12 May, some NHS services had to turn away non-critical emergencies, and some ambulances were diverted.[11][58] In 2016, thousands of computers in 42 separate NHS trusts in England were reported to be still running Windows XP.[49] NHS hospitals in Wales and Northern Ireland were unaffected by the attack.[9][11]
Nissan Motor Manufacturing UK in Tyne and Wear, England halted production after the ransomware infected some of their systems. Renault also stopped production at several sites in an attempt to stop the spread of the ransomware.[59][60]
The attack's impact could have been much worse had an anonymous security expert, who was independently researching the malware, not discovered that a kill-switch had been built in by its creators.[61][62]
Cybersecurity expert Ori Eisen said that the attack appears to be "low-level" stuff, given the ransom demands of $300 and states that the same thing could be done to crucial infrastructure, like nuclear power plants, dams or railway systems.[63]
https://en.wikipedia.org/wiki/WannaCry_ransomware_attack
But still i am looking for this vulnuable attacking malware executeable, so i can try to help in such regards.
if any one who is having infected system, please contact me using our live chat buttong, i may help or guide your for the same. how to deal with.
as we are a team of professional who take care of systems and network infra.
Posted:
6 years ago
|