1. The Day Ransomware Went Global

On 12 May 2017, organisations across multiple countries began experiencing a rapidly spreading ransomware outbreak. Computers became inaccessible, files were encrypted, and ransom demands appeared on affected screens.

One of the most widely reported impacts was on the United Kingdom's National Health Service (NHS). Hospitals and healthcare facilities experienced significant disruption, with some appointments cancelled and systems taken offline as staff worked to contain the infection.

The malware responsible became known as WannaCry, also referred to as WannaCrypt or WanaCrypt0r.

Its impact was not limited to healthcare. Businesses, telecommunications providers, manufacturers, and public-sector organisations were affected in different countries.

What made WannaCry particularly dangerous was its ability to combine two functions: encrypting files for ransom and spreading to other vulnerable Windows computers.

A single compromised machine could become the starting point for a much larger outbreak.

2. What Was WannaCry?

WannaCry was a ransomware family that encrypted files on infected Windows systems and demanded payment in Bitcoin for the possibility of recovering them.

Ransomware is malicious software designed to deny access to data or systems until a ransom is demanded. In WannaCry's case, the malware encrypted files and displayed instructions directing victims to a ransom payment process.

However, WannaCry was not simply a file-encrypting program. It also contained worm-like propagation capabilities.

A traditional ransomware infection might spread through a malicious email attachment, a compromised download, or a user executing a malicious file. WannaCry's network-spreading capability allowed it to search for other systems that were vulnerable to its exploitation method.

This meant that organisations could experience widespread infections without every affected employee opening a malicious email.

The key distinction: WannaCry combined ransomware with automated network propagation, allowing it to spread rapidly across exposed and vulnerable systems.

3. How Did WannaCry Spread?

The outbreak was associated with EternalBlue, an exploit targeting a vulnerability in Microsoft's implementation of SMBv1, tracked as CVE-2017-0144.

SMB is a Windows networking protocol commonly used for file and printer sharing. The vulnerability affected systems that had not applied Microsoft's security updates.

EternalBlue was publicly associated with leaked tools linked to the Equation Group. WannaCry used the exploit to target vulnerable Windows systems, helping the malware move between computers.

Microsoft had released security update MS17-010 in March 2017, before the outbreak. Systems that remained unpatched were at risk.

The outbreak therefore exposed a critical weakness in many organisations: security updates were available, but vulnerable systems had not all been patched.

4. Inside the WannaCry Attack Chain

Understanding the attack chain helps security teams recognise how a single vulnerability can lead to a large-scale incident.

Stage 1: Identifying vulnerable systems

WannaCry attempted to identify systems reachable over the network that exposed the relevant SMB service. Systems using vulnerable versions of Windows and lacking the necessary security update were at risk.

Stage 2: Exploiting the SMB vulnerability

The malware used the EternalBlue exploit to target the SMBv1 vulnerability. Successful exploitation could enable unauthorised code execution on a vulnerable system.

The exact outcome depended on the target system and its configuration.

Stage 3: Executing the malware

Once the malware gained the ability to execute on a system, it could begin its ransomware activity and attempt to propagate further.

Stage 4: Encrypting files

WannaCry encrypted files on infected computers and presented ransom instructions. The affected files could no longer be accessed normally without an appropriate recovery method.

Stage 5: Spreading across the network

The malware attempted to locate additional vulnerable computers, allowing infections to spread across reachable networks.

This propagation behaviour helped turn individual infections into a large-scale outbreak, particularly within organisations that had flat networks or numerous unpatched Windows systems.

5. The Kill Switch That Helped Slow the Outbreak

One unusual aspect of WannaCry was a domain-checking mechanism discovered during analysis of the malware.

A security researcher identified that the malware attempted to contact a particular hardcoded domain. When the domain was registered and responded as expected, the malware's execution could be interrupted, helping slow the spread of the original variant.

This mechanism became widely known as WannaCry's kill switch.

However, the kill switch was not a substitute for patching or incident response. It did not decrypt files that had already been encrypted, and it did not guarantee that every infected system or variant would stop operating.

The incident demonstrated the importance of rapid malware analysis. A single discovery about the malware's behaviour helped defenders disrupt part of the outbreak, but organisations still needed to contain infections and secure vulnerable systems.

6. Why Was the Impact So Severe?

Several factors contributed to WannaCry's global impact.

Unpatched Windows systems: Security updates addressing the relevant vulnerability were available before the outbreak, but many systems remained exposed.

Network connectivity: Systems that could communicate with vulnerable computers created opportunities for rapid propagation.

Legacy technology: Organisations sometimes depended on older operating systems or specialised equipment that could be difficult to update immediately.

Insufficient network segmentation: Where systems could communicate too freely, malware had more opportunities to move between machines.

Operational dependencies: Hospitals and other critical organisations rely on computer systems for scheduling, communications, records, and day-to-day operations. Disruption to those systems can affect essential services even when not every device is infected.

Limited recovery readiness: Backups, restoration procedures, and incident response plans determine how quickly an organisation can recover from a ransomware incident.

WannaCry was not simply a story about malicious software. It was also a lesson in how technical vulnerabilities, operational constraints, and gaps in security management can combine to create a major incident.

7. How Should a SOC Analyst Investigate a WannaCry-Like Incident?

For a Security Operations Centre (SOC), the priority is to establish the scope of the incident, identify the propagation mechanism, and contain affected systems.

Step 1: Validate the alert

Review EDR, antivirus, SIEM, and network security alerts for suspicious encryption activity, unusual SMB connections, and known ransomware indicators.

Determine whether the event represents confirmed malicious activity, a blocked exploit attempt, or a potentially false positive.

Step 2: Identify affected hosts

Collect the hostnames, IP addresses, logged-in users, operating system versions, and timestamps associated with alerts.

Look for multiple endpoints reporting similar behaviour within a short period. A cluster of related alerts may indicate a spreading infection rather than an isolated event.

Step 3: Examine SMB traffic

Investigate unexpected or excessive connections involving TCP port 445, which is commonly used by SMB.

Look for one host attempting to connect to many internal systems, especially where those connections coincide with exploit alerts or ransomware execution.

Port 445 traffic alone does not confirm WannaCry; legitimate Windows file sharing also uses SMB.

Step 4: Review endpoint telemetry

Use EDR and Windows event data to investigate:

• Suspicious processes and process execution times.

• Files created or modified shortly before encryption activity.

• Ransom notes and unusual file-extension changes.

• Security alerts involving SMB exploitation.

• Connections between the first affected host and subsequent endpoints.

Preserve relevant logs and forensic evidence according to the organisation's incident response procedures.

Step 5: Determine the initial entry point

Establish whether the incident involved exploitation of vulnerable SMB services or another infection route.

Do not assume that every ransomware incident involving SMB traffic is WannaCry. Correlate endpoint, network, and threat-intelligence evidence before assigning a malware family.

Step 6: Contain the outbreak

Isolate confirmed infected endpoints from the network. Restrict unnecessary SMB communication, particularly between systems that do not need to exchange files.

Coordinate containment with infrastructure and business teams to avoid unnecessary disruption to critical services.

Step 7: Eradicate and recover

Patch vulnerable systems, remove malicious components, validate that the threat has been contained, and restore affected data from trusted backups where required.

Monitor the environment for renewed encryption activity, suspicious SMB connections, and other signs of continued compromise.

8. Indicators and Investigation Clues

WannaCry investigations should combine multiple evidence sources rather than relying on one indicator.

Evidence sourceWhat to investigateNetwork telemetryUnexpected SMB connections over TCP port 445, especially between numerous internal hostsEndpoint alertsRansomware detections, suspicious process execution, and exploit-related alertsFile-system evidenceRapid file modifications, encrypted files, and ransom-note creationWindows security postureVulnerable operating systems, SMBv1 exposure, and missing MS17-010 updatesTimeline evidenceThe earliest suspicious activity and the sequence of subsequent host infectionsThreat intelligenceVerified WannaCry hashes, domains, and other indicators from trusted sources

Important: These are investigation clues, not unique WannaCry indicators. SMB traffic, encrypted files, and ransom notes can occur in other incidents. Confirm attribution through reliable malware analysis and corroborating evidence.

9. MITRE ATT&CK Mapping

WannaCry's documented behaviour can be mapped to relevant MITRE ATT&CK techniques. These mappings describe observed attack behaviours and should be validated against the specific evidence available during an investigation.

TechniqueIDRelevanceExploitation of Remote ServicesT1210Exploiting a vulnerable network service to access other systemsSMB/Windows Admin SharesT1021.002Relevant to SMB-based lateral movement investigations; do not assume this technique was used without supporting evidenceFile and Directory DiscoveryT1083Relevant when investigating file enumeration behaviourData Encrypted for ImpactT1486Encrypting files to disrupt access to dataNetwork Service DiscoveryT1046Relevant to investigating network scanning and service discovery

10. How Organisations Can Defend Against WannaCry-Like Attacks

The most effective lessons from WannaCry remain relevant to modern ransomware defence.

Apply security patches promptly. Prioritise vulnerabilities affecting exposed network services and maintain visibility into systems that cannot be patched immediately.

Disable SMBv1 where it is not required. Review legacy dependencies before making changes, and use supported SMB configurations.

Restrict SMB traffic. Block unnecessary TCP port 445 access, especially from the internet, and limit communication between internal network segments.

Segment critical systems. Separate sensitive infrastructure and legacy equipment so that a compromise in one area does not automatically expose the entire environment.

Use EDR and centralised monitoring. Detect suspicious exploit behaviour, rapid file modifications, unusual process execution, and coordinated activity across multiple endpoints.

Maintain tested backups. Keep backups isolated or otherwise protected against compromise, and regularly test restoration procedures.

Prepare an incident response plan. Define isolation procedures, escalation paths, forensic evidence handling, recovery responsibilities, and communication processes before an incident occurs.

Retire unsupported systems. Where older operating systems remain operationally necessary, apply compensating controls and a documented plan to reduce their exposure.

11. Lessons from WannaCry

WannaCry changed how many organisations viewed ransomware risk. It demonstrated that an attack could spread beyond the initial infection and disrupt entire networks by exploiting a vulnerability for which a security update was already available.

For defenders, the central lesson is that security depends on more than detecting malicious files. Organisations must also understand their assets, maintain patch coverage, control network communication, and prepare to respond when preventive measures fail.

For SOC analysts, WannaCry remains a useful case study in correlating endpoint alerts, network behaviour, vulnerability information, and incident timelines.

For security leaders, it highlights the operational consequences of delayed patching and inadequate recovery preparation.

Conclusion

WannaCry became one of the most significant ransomware outbreaks in modern cybersecurity history because it combined file encryption with rapid network propagation. The exploitation of vulnerable SMB services allowed the outbreak to spread widely, while gaps in patching and network controls increased its impact.

The enduring lesson is clear: a vulnerability that remains unpatched can become the starting point for an organisation-wide crisis.

Effective defence requires timely patching, restricted network access, layered detection, tested backups, and a rehearsed incident response process. These measures cannot eliminate every threat, but they can significantly reduce the likelihood that one compromised system becomes a widespread disruption.

Further Reading

• Microsoft Security Bulletin MS17-010 — security updates addressing the SMB vulnerability.

• NIST Computer Security Resource Center — ransomware prevention and incident response guidance.

• MITRE ATT&CK — techniques for analysing exploitation, lateral movement, and ransomware impact.