WannaCry Ransomware Attack: Timeline, Impact and Lessons

The WannaCry ransomware attack was a worm outbreak that spread across more than 150 countries on May 12, 2017, encrypting Windows computers that had not installed Microsoft's MS17-010 security update. It moved on its own through the SMBv1 file-sharing protocol using EternalBlue, an exploit leaked a month earlier, and was halted within hours by a "kill switch" domain. It disrupted a third of England's hospital trusts. The US, UK and allies attributed it to North Korea in December 2017. This profile covers the timeline, how it spread, the impact, attribution and the defenses that still matter.

The quick answer

The one line to remember: WannaCry did not need a phishing click or a stolen password. One unpatched, reachable Windows host was enough.

What Was WannaCry?

WannaCry was a self-spreading ransomware program that encrypted files on Windows systems and demanded payment in bitcoin. Unlike most ransomware, which arrives by email or through stolen remote-access credentials, it carried a worm component that scanned for other computers and infected them through a vulnerability in Microsoft's Server Message Block version 1 (SMBv1) protocol.

The ransom note asked for about $300 in bitcoin, according to CISA alert TA17-132A, and CISA noted the software could run in as many as 27 languages. In practice, paying was a poor bet. At the US attribution briefing in December 2017, the White House said that paying the demands did not unlock victims' computers.

MITRE tracks the malware as WannaCry (S0366) and maps its behavior to techniques that defenders still see in modern attacks: exploitation of remote services (T1210) to spread, data encrypted for impact (T1486), and deletion of Volume Shadow Copies to block easy recovery (T1490). MITRE also lists the Lazarus Group as the group associated with the software.

What made WannaCry historic was not technical sophistication. It was the combination of a leaked, highly reliable network exploit with ransomware, released into a world where many organizations had not applied a patch that had been available for two months.

The WannaCry Timeline

WannaCry's story starts before the outbreak and ends long after it. The dates below come from Microsoft, CISA, NVD and the governments involved.

Two gaps in that table explain most of the damage. The patch was public 59 days before the outbreak, and the exploit was public 28 days before it. Organizations with a working patch management process for critical updates were largely protected. Those that patched slowly, or ran systems Microsoft no longer supported, were not.

How WannaCry Spread: EternalBlue, MS17-010 and DoublePulsar

WannaCry's worm used three building blocks. The explanation below is conceptual: it covers what each part did, not how to reproduce it.

SMBv1 and MS17-010. SMB is the protocol Windows uses for file and printer sharing, normally over TCP port 445. Version 1 dates from an earlier era of networking. Microsoft's MS17-010 bulletin, published March 14, 2017, fixed several flaws that let a remote attacker run code by sending specially crafted messages to an SMBv1 server. It was rated Critical for every supported Windows release. Microsoft had already told administrators to stop using SMB1 in September 2016.

EternalBlue. EternalBlue was an exploit for one of those flaws. It was part of a set of tools the Shadow Brokers group released publicly on April 14, 2017. Microsoft President Brad Smith wrote on May 14, 2017 that the exploits used in the attack were drawn from those stolen from the US National Security Agency. Because it needs no credentials and no user action, any unpatched host that can reach another host's port 445 can be compromised.

DoublePulsar. DoublePulsar was a kernel-level backdoor released in the same leak. Microsoft's analysis of WannaCrypt found that WannaCry ran kernel code that appeared to be copied from DoublePulsar, adjusted to drop and run the ransomware on 32-bit and 64-bit systems.

Which CVE is EternalBlue?

MS17-010 covers six CVEs, CVE-2017-0143 through CVE-2017-0148. Most references, including the CISA Known Exploited Vulnerabilities entry, associate EternalBlue with CVE-2017-0144, which NVD describes as an SMBv1 remote code execution flaw affecting Windows Vista through Windows Server 2016. Microsoft's May 2017 WannaCrypt analysis cited CVE-2017-0145, a sibling flaw in the same bulletin. For defenders the distinction does not change the action: both are fixed by MS17-010, and both were added to the KEV catalog on February 10, 2022.

The infection flow

Once running on a computer, WannaCry did four things in order, according to Microsoft and CISA. It scanned both the local network and randomly generated internet IPv4 addresses for systems listening on port 445. It used EternalBlue against hosts missing MS17-010. It used the DoublePulsar-derived code to run its dropper on each new victim. Then, before encrypting anything, it tried to contact a hard-coded web domain. If the domain did not answer, it encrypted files, deleted Volume Shadow Copies, displayed the ransom note and started the next round of scanning.

Microsoft noted that its exploit code worked against unpatched Windows 7, Windows Server 2008 and earlier systems, and that Windows 10 was not affected by this attack. The initial entry point was never confirmed. Early reporting suspected phishing, and CISA's first alert listed it as a possibility, but the worm design meant one exposed SMB service was enough. Inside a flat network, the same mechanism turned one infection into many, the pattern our guide to lateral movement describes.

The Kill Switch: How WannaCry Was Stopped

Every copy of WannaCry checked whether an unregistered, random-looking domain answered before doing any damage. On May 12, a security researcher, widely reported to be Marcus Hutchins, noticed the domain in the code and registered it. From then on, new infections found the domain alive and stopped without encrypting or spreading. The UK National Audit Office later concluded that the attack "could have caused more disruption" if the kill switch had not been activated, and that NHS regions hit early that morning, before activation, saw more infections.

Three details matter for defenders:

• The check was not proxy-aware. Microsoft warned that machines that could reach the internet only through a proxy might fail the check and run anyway. Its guidance was to make the domain resolve internally if needed.
• Blocking the domain was the wrong move. For once, defenders were told not to block a malicious domain, because blocking it would make the malware think the kill switch was off.
• The kill switch stopped new detonations, not existing damage. Computers already encrypted stayed encrypted. Recovery depended on backups.

Why the authors built a kill switch is not known. One common theory is that it was meant to detect analysis sandboxes, which often answer every domain lookup. Whatever the intent, it shows how much a single observer reading the code can change the course of an outbreak.

Impact: The NHS and the Wider World

The NHS

England's National Health Service is the best-documented victim, thanks to the UK National Audit Office's investigation of WannaCry and the NHS, published October 27, 2017, and a later Department of Health and Social Care cost estimate.

The NAO found that every infected organization shared the same weakness: unpatched or unsupported Windows systems. It also found that managing internet-facing firewalls would have protected organizations whether or not they had patched. NHS Digital had issued critical alerts in March and April 2017 telling organizations to patch, but before May 12 the department had no formal way to check whether local bodies had acted. NHS Digital said it believed no patient data was compromised or stolen.

The cost figure comes from the department's September 2018 progress update, which calls it an approximate estimate because no data was systematically collected during the response. The same document describes new investment in local infrastructure and a national Windows 10 licensing agreement that followed the attack. For broader context on how the sector has fared since, see our healthcare cybersecurity statistics.

Global estimates

Counts of affected computers vary because they come from different sources at different times:

• CISA's alert on May 12 cited open-source reports of tens of thousands of infections in over 150 countries, including the United States, United Kingdom, Spain, Russia, Taiwan, France and Japan.
• The White House said on December 19, 2017 that WannaCry rendered "hundreds of thousands of computers" useless in hospitals, schools, businesses and homes in over 150 countries.
• The UK Foreign Office put the figure at 300,000 computers in 150 countries, including 48 NHS trusts by its count.

No government has published an authoritative global cost. A private estimate of up to US$4 billion is widely repeated, including on Wikipedia, but its method is not public, so treat it as an order-of-magnitude figure rather than a measurement. The NHS figure above is the most rigorous cost estimate available for any single victim. For current ransomware cost and frequency data, see our ransomware statistics.

Who Was Behind WannaCry?

Attribution came seven months after the attack, from several governments acting together. The wording each used matters.

The White House briefing and the UK Foreign Office statement were coordinated on the same day. The Treasury designation stated that the Justice Department unsealed criminal charges against the same individual. The Council of the EU noted that its sanctions "should be distinguished from attribution of responsibility to a third state."

Two cautions help readers use this record well. First, "highly likely" is an intelligence assessment, not a court finding, and a criminal complaint is an allegation. Some researchers have questioned parts of the attribution. Second, WannaCry looks unlike most later North Korean operations, which focus on theft, especially of cryptocurrency, as our article on how North Korean hackers stole billions in crypto explains. Our Lazarus Group profile covers the wider actor and the same attribution caveats.

Lessons From WannaCry, and Why SMBv1 Still Shows Up

Nearly a decade later, WannaCry's lessons are mostly about basics that are hard to do everywhere at once.

1. Patch critical, wormable flaws on a deadline, not a cycle. MS17-010 was out two months early. A wormable, unauthenticated network flaw deserves an emergency path, the same thinking behind our zero-day exploit guide.
2. Unsupported systems are a known liability. The NHS had been told in 2014 to plan its move away from Windows XP. Systems that cannot be patched need isolation, not hope.
3. Flat networks turn one infection into an outbreak. Internal SMB was the highway. Segmentation decides whether a worm reaches ten machines or ten thousand.
4. Backups decide whether you pay. WannaCry deleted shadow copies on purpose. Offline or immutable backups with tested restores are what made recovery possible.
5. Response plans need practice. The NAO found the health department had a plan but had not tested it locally. A rehearsed incident response plan shortens the first confused hours.

Why unpatched SMBv1 still appears in internal tests

Microsoft stopped installing SMBv1 by default starting with Windows 10 and Windows Server version 1709, and Windows 11 does not include it by default. Yet SMBv1 and missing MS17-010 patches are still a recurring finding in internal network assessments. The reasons are structural:

• Upgrades carry old settings forward. Microsoft's SMBv1 documentation notes that in-place upgrades do not automatically remove SMBv1 at first, so a modern Windows version can still have it.
• Old software and devices require it. Legacy applications, older network storage, printers and scanners that only speak SMBv1 lead administrators to re-enable it.
• Vendor-locked equipment lags. In February 2018, CISA published advisory ICSMA-18-058-02 for a medical imaging platform affected by the MS17-010 CVEs, nine months after the outbreak. Clinical, laboratory and industrial systems often need vendor approval before patching.
• "Not internet-facing" becomes "never patched." Internal servers outside the normal patch cycle are exactly what a worm or a human attacker on the inside looks for.

That is why an internal penetration test still checks for SMBv1 and missing MS17-010 patches in 2026: the question is not whether the flaw is old, but whether any host in your environment still has it.

How to Detect WannaCry-Style Activity

WannaCry itself is easy for modern endpoint tools to recognize. The behaviors behind it, wormable SMB exploitation, mass scanning and recovery sabotage, still show up in newer threats, so detections should target behavior, not one malware family.

Indicators of compromise and detection rules from 2017 are available in CISA alert TA17-132A. If DNS logs show the kill-switch domains, investigate the host rather than blocking the lookup.

To find SMBv1 before an attacker does, Microsoft documents built-in PowerShell checks. The commands below only read configuration:

# Is the SMBv1 optional feature installed? (Windows client and server, run as administrator)
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

# Is the SMBv1 server enabled? (no elevation needed)
Get-SmbServerConfiguration | Format-List EnableSMB1Protocol

Run them through your endpoint management tool across the estate, and pair them with a network-side view so you also catch printers, storage and appliances that PowerShell cannot reach. Microsoft's SMB detection and disable guide covers removal on each Windows version.

How to Prevent WannaCry-Style Attacks

The controls that would have stopped WannaCry are well known. The hard part is applying them to every host, including the ones nobody remembers.

Two points from the NAO findings are worth repeating for any large organization. Patching alone was not the only control that worked: well-managed internet-facing firewalls also protected NHS bodies. And central guidance is not the same as central assurance. If you cannot measure whether a critical patch reached every site, you do not know whether you are protected. Our guide to vulnerability management covers how to turn scanning into tracked remediation.

How to Validate Your Defenses Safely

Checking for WannaCry-style exposure does not require running WannaCry or any exploit against production systems. A safe validation program usually covers:

• Discovery: find every host that answers on TCP 445 and record which SMB versions it supports, including non-Windows devices.
• Patch verification: confirm MS17-010 and current updates with authenticated scans, and reconcile the results with the asset inventory.
• Segmentation testing: from representative user, server and guest network segments, check which other segments can reach port 445.
• Recovery testing: restore a sample of critical systems from backup on a schedule and time it.
• Attack-path review: in an authorized engagement, have testers show how an attacker inside the network would move between hosts, which accounts and services make that possible, and which controls stopped them.

The last step is where an internal test or network penetration test adds most value: it checks the assumptions in your patch reports and firewall rules against what an attacker on the inside can actually reach.

FAQ

What was the WannaCry ransomware attack?

WannaCry was a global ransomware outbreak that began on May 12, 2017. A self-spreading worm infected Windows computers through an SMBv1 flaw that Microsoft had patched in MS17-010 two months earlier, encrypted their files and demanded about $300 in bitcoin. It reached over 150 countries before a kill switch halted it.

Who was behind WannaCry?

The United States publicly attributed WannaCry to North Korea on December 19, 2017, joined by the UK, Australia, Canada, New Zealand and Japan. The UK said it was "highly likely" that the Lazarus Group was responsible. In September 2018, US prosecutors charged North Korean programmer Park Jin Hyok, and Treasury sanctioned him.

How was WannaCry stopped?

A researcher registered a domain that WannaCry checked before running. Once the domain answered, new infections stopped without encrypting files or spreading. Computers already encrypted were not restored, and machines behind proxies could still detonate because the check was not proxy-aware.

What were EternalBlue and DoublePulsar?

EternalBlue was an exploit for an SMBv1 remote code execution flaw fixed by MS17-010, publicly leaked by the Shadow Brokers on April 14, 2017. DoublePulsar was a kernel backdoor from the same leak. WannaCry used EternalBlue to break in and code adapted from DoublePulsar to run its payload.

How much did WannaCry cost the NHS?

The UK Department of Health and Social Care estimated the cost at about £92 million: £19 million in lost output and £73 million in IT costs. The National Audit Office found at least 81 of 236 hospital trusts affected and estimated more than 19,000 appointments cancelled. No NHS organization paid the ransom.

Did paying the WannaCry ransom unlock files?

Not reliably. The White House said in December 2017 that paying the demands did not unlock victims' computers. The NHS did not pay. Recovery for most victims came from backups and rebuilding systems.

Is WannaCry still a threat in 2026?

The original 2017 campaign is over, and patched or SMBv1-free systems are not vulnerable to it. The underlying risk remains wherever MS17-010 is missing or SMBv1 is still enabled, which internal assessments continue to find on legacy servers, storage devices and vendor-managed equipment.

Next Step: Check Your Network for the WannaCry Gap

WannaCry succeeded because of gaps that are easy to describe and hard to close everywhere: a missed critical patch, an old protocol left on, a flat internal network and backups that had not been tested. The useful questions for 2026 are concrete. Does every host that speaks SMB, including printers, storage and clinical or industrial devices, have SMBv1 off? Can a workstation in one segment reach port 445 on servers in another? Would you know within minutes if one host began scanning the rest?

DeepStrike's penetration testing services include infrastructure penetration testing and red team engagements, with every assessment conducted manually. To scope an internal network test that checks for legacy protocols, missing patches and lateral movement paths, contact DeepStrike.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

• Microsoft Security Bulletin MS17-010 - Critical (March 14, 2017)
• Microsoft Security Blog: WannaCrypt ransomware worm targets out-of-date systems (May 12, 2017)
• Microsoft On the Issues: The need for urgent collective action to keep people safe online (May 14, 2017)
• Microsoft Tech Community: Stop using SMB1 (first published September 16, 2016)
• Microsoft Learn: SMBv1 not installed by default in Windows Server and Windows
• Microsoft Learn: How to detect, enable and disable SMBv1, SMBv2 and SMBv3
• CISA Alert TA17-132A: Indicators Associated With WannaCry Ransomware
• CISA ICS Medical Advisory ICSMA-18-058-02 (February 27, 2018)
• NVD: CVE-2017-0144
• NVD: CVE-2017-0145
• MITRE ATT&CK: WannaCry (S0366)
• UK National Audit Office: Investigation: WannaCry cyber attack and the NHS (October 27, 2017)
• UK Department of Health and Social Care: Securing cyber resilience in health and care, September 2018 update
• The White House: Press Briefing on the Attribution of the WannaCry Malware Attack to North Korea (December 19, 2017)
• UK Foreign Office: Foreign Office Minister condemns North Korean actor for WannaCry attacks
• US Treasury: Treasury Targets North Korea for Multiple Cyber-Attacks (September 6, 2018)
• Council of the EU: EU imposes the first ever sanctions against cyber-attacks (July 30, 2020)
• Wikipedia: WannaCry ransomware attack
• Wikipedia: EternalBlue