On 12 May 2017, a single compromised computer marked the start of one of the fastest-spreading ransomware incidents in history. Within hours, the WannaCry worm had encrypted files on systems belonging to hospitals, factories, transport operators and government agencies across dozens of countries.
British hospitals displayed ransom notes demanding Bitcoin payments while patient records became inaccessible. Operations were cancelled and staff reverted to paper records. In France, several Renault plants halted production lines to contain the spread. Nissan facilities in the UK, Deutsche Bahn in Germany, Telefónica in Spain and FedEx in the United States all reported disruptions on the same day.
The malware did not rely on phishing emails or user actions. Instead it used the EternalBlue exploit, leaked weeks earlier by the Shadow Brokers group, to attack unpatched Windows systems over SMBv1. Microsoft had already issued security update MS17-010 in March 2017, yet many organisations had not applied it.
Propagation mechanism
After execution, WannaCry enumerated local network interfaces and scanned those subnets. Simultaneously, separate threads generated random public IPv4 addresses and attempted TCP connections on port 445. Successful connections triggered EternalBlue exploitation attempts. Up to 128 parallel scanning threads allowed rapid coverage of address space.
When exploitation succeeded, the worm copied itself to the new host and resumed scanning. This autonomous replication turned each newly infected machine into an additional infection source, enabling exponential growth across organisational and national boundaries.
Kill-switch intervention
Security researcher Marcus Hutchins discovered a hardcoded domain check inside the binary. Registering the domain caused the malware to terminate before encrypting files or propagating further. The measure stopped the original strain, although subsequent variants removed the check.
Analysis by Mandiant later confirmed the dual local-and-internet scanning behaviour and the use of built-in components for payload delivery after successful exploitation.
