Malware
malware:wannacry
Also: Wana, WanaCrypt, WannaCry cyber-attack, WannaCry worm
Worm described as spreading similarly to Conficker by exploiting systems that had not applied the relevant patch.
Worm described as spreading similarly to Conficker by exploiting systems that had not applied the relevant patch.
“the WannaCry worm was unleashed and spread in a very similar way”
Ransomware that encrypted files and propagated across vulnerable Windows networks in 2017.
“this ransomware which was encrypting the files was called WanaCrypt”
“people quickly just started calling this ransomware WannaCry”
Ransomware described as a 2017, auto-spreading cyberattack attributed in the episode to the Lazarus Group.
“May 2017, of course, was the WannaCry cyber-attack, the ransomware attack”
“the WannaCry attack was also attributed to the Lazarus Group”
Ransomware described as wormable, capable of spreading automatically from computer to computer and encrypting systems.
“The ransomware would soon be called WannaCry”
“this ransomware spreads from computer to computer, completely unaided”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | EternalBlue | Explicit | 57 |
| outgoing | USES | EternalBlue | Explicit | 73 |
| outgoing | USES | EternalBlue | Derived | 158 |
| outgoing | AFFECTS | Windows | Explicit | 73 |
| outgoing | AFFECTS | Windows | Derived | 158 |
| outgoing | USES | ransomware | Explicit | 73 |
| outgoing | USES | ransomware | Explicit | 158 |
| outgoing | USES | DoublePulsar | Explicit | 73 |
| outgoing | USES | self-propagating worm | Explicit | 73 |
| outgoing | USES | lateral movement | Explicit | 73 |
| outgoing | USES | kill switch | Explicit | 73 |
| outgoing | DISCOVERED_BY | Marcus Hutchins | Explicit | 73 |
| outgoing | ATTRIBUTED_TO | Park Jin Hyok | Attributed | 73 |
| outgoing | ATTRIBUTED_TO | North Korea | Attributed | 73 |
| outgoing | ATTRIBUTED_TO | North Korea | Attributed | 158 |
| outgoing | ATTRIBUTED_TO | Lazarus Group | Attributed | 119 |
| outgoing | USES | cryptocurrency mixer | Explicit | 119 |
| outgoing | USES | wormable propagation | Explicit | 158 |
| outgoing | USES | Bitcoin | Explicit | 158 |
| outgoing | USES | WannaCry kill switch domain | Explicit | 158 |
| incoming | INVOLVES | WannaCry | Explicit | 73 |
| incoming | INVOLVES | WannaCry | Explicit | 119 |
| incoming | INVOLVES | WannaCry | Explicit | 158 |
WannaCry USES EternalBlue
WannaCry used EternalBlue in a similar worm-like spreading pattern against systems that had not patched.
Explicit Confidence 95% · John Lambert EP 57 Details
“A couple months later, the WannaCry worm was unleashed and spread in a very similar way”
The WannaCry incident involved the WanaCrypt/WannaCry ransomware.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“this ransomware which was encrypting the files was called WanaCrypt”
WannaCry targeted Windows computers, particularly network-connected computers.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“this ransomware was targeting Windows computers and specifically, Windows computers that were connected to the network”
WannaCry USES ransomware
WannaCry encrypts files and demands payment to unlock them, functioning as ransomware.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“This is a typical ransomware message”
WannaCry USES EternalBlue
WannaCry used the EternalBlue exploit.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“The exploit this malware was using was EternalBlue”
WannaCry USES DoublePulsar
Matt Suiche said the malware was using DoublePulsar together with EternalBlue.
Explicit Confidence 98% · Matt Suiche EP 73 Details
“it was using the DoublePulsar on EternalBlue”
WannaCry USES self-propagating worm
WannaCry was a self-propagating worm that attempted to infect other computers on a local network.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“this ransomware was a self-propagating worm”
WannaCry USES lateral movement
After infecting one computer, WannaCry attempted to spread to other computers inside the local network.
Explicit Confidence 98% · Jack Rhysider EP 73 Details
“it would then look to try to infect every other computer in that local network”
WannaCry USES kill switch
WannaCry checked a specific URL and stopped running when the URL was active, implementing a kill switch.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“This is called a kill switch”
WannaCry DISCOVERED_BY Marcus Hutchins
Marcus Hutchins discovered the kill-switch URL and its behavior while analyzing WannaCry.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“when Marcus Hutchins found this URL in the code”
WannaCry ATTRIBUTED_TO Park Jin Hyok
The U.S. Department of Justice charged Park Jin Hyok in connection with a conspiracy that included creating the WannaCry ransomware.
Attributed Confidence 98% · Doj EP 73 Details
“creating the WannaCry ransomware”
WannaCry ATTRIBUTED_TO North Korea
The U.S. Department of Justice attributed the broader cyber-attack conspiracy, including WannaCry, to actors operating on behalf of the North Korean government.
Attributed Confidence 97% · Doj EP 73 Details
“a conspiracy that conducted sophisticated cyber-attacks around the world on behalf of the North Korean government”
The WannaCry incident is described as a ransomware cyber-attack that infected hundreds of thousands of devices.
Explicit Confidence 99% · Geoff White EP 119 Details
“the WannaCry cyber-attack, the ransomware attack that hit multiple countries”
WannaCry ATTRIBUTED_TO Lazarus Group
The WannaCry attack was attributed to the Lazarus Group, according to the episode's discussion.
Attributed Confidence 98% · Geoff White EP 119 Details
“the WannaCry attack was also attributed to the Lazarus Group”
WannaCry USES cryptocurrency mixer
The attackers moved WannaCry ransom payments through wallets and cryptocurrency mixers to launder them.
Explicit Confidence 96% · Geoff White EP 119 Details
“the money being moved around, moved to different wallets, tumbled”
WannaCry USES EternalBlue
The episode describes North Korea picking up the leaked EternalBlue exploit and making ransomware with it; the link between WannaCry and EternalBlue is presented in that account.
Derived Confidence 94% · Malwaretech EP 158 Details
“North Korea pick it up and decide to make ransomware with it”
WannaCry ATTRIBUTED_TO North Korea
WannaCry is attributed to someone working on behalf of the North Korean government; later, intelligence services publicly pointed to North Korea.
Attributed Confidence 96% · Malwaretech EP 158 Details
“I think the consensus is that it was someone working on behalf of the North Korean government.”
“the NSA and GCHQ and I think the Australian intelligence services, they all came out and they pointed the finger at North Korea”
WannaCry USES ransomware
WannaCry is described as ransomware that encrypted computers and demanded Bitcoin for recovery.
Explicit Confidence 99% · Jack Rhysider EP 158 Details
“The ransomware would soon be called WannaCry”
“you had to pay Bitcoin to get it unlocked again”
WannaCry USES wormable propagation
WannaCry is described as wormable ransomware that spreads from computer to computer without user action.
Explicit Confidence 99% · Malwaretech EP 158 Details
“I didn’t think anyone had ever made wormable ransomware before.”
“this ransomware spreads from computer to computer, completely unaided.”
WannaCry used Bitcoin payments as part of its ransomware operation.
Explicit Confidence 98% · Jack Rhysider EP 158 Details
“you had to pay Bitcoin to get it unlocked again”
WannaCry infected and encrypted Windows computers.
Derived Confidence 96% · Jack Rhysider EP 158 Details
“Their computers would get infected and then completely encrypted.”
The WannaCry incident involved the WannaCry ransomware outbreak.
Explicit Confidence 99% · Jack Rhysider EP 158 Details
“The ransomware would soon be called WannaCry, and it was hitting tons of hospitals around the UK.”
WannaCry USES WannaCry kill switch domain
WannaCry checked a domain in its code, and the domain's activation functioned as a kill switch that stopped the malware from spreading.
Explicit Confidence 99% · Malwaretech EP 158 Details
“the domain was a kill switch”
“the malware stops everything it’s doing”