The WannaCry incident involved the WanaCrypt/WannaCry ransomware.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“this ransomware which was encrypting the files was called WanaCrypt”
Episode
01 September 2020 Official episode · Official transcript
advanced persistent threat cybercrime incident response
The episode examines the 2017 WannaCry ransomware outbreak, its use of EternalBlue against SMB, the kill-switch domain registrations that curtailed later variants, and the U.S. attribution of the campaign to North Korean actors.
Topics: WannaCry ransomware propagation, EternalBlue exploitation, SMB file-sharing vulnerabilities, Self-propagating worms and lateral movement, Ransomware payment and file recovery, Kill-switch domains, Malware reverse engineering, Windows patching and unsupported systems, Threat intelligence and attribution, Cryptocurrency tracing and Monero, North Korean state-linked cyber operations
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
The WannaCry incident involved the WanaCrypt/WannaCry ransomware.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“this ransomware which was encrypting the files was called WanaCrypt”
WannaCry INVOLVES National Health Service
The incident hit hospitals in the UK's National Health Service.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“was hitting other hospitals in UK’s NHS, their National Health Service”
WannaCry TARGETS National Health Service
The NHS was among the major networks affected by the worldwide ransomware campaign.
Explicit Confidence 98% · Jack Rhysider EP 73 Details
“The NHS is one of the bigger networks to be hit by this”
WannaCry targeted Windows computers, particularly network-connected computers.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“this ransomware was targeting Windows computers and specifically, Windows computers that were connected to the network”
WannaCry USES ransomware
WannaCry encrypts files and demands payment to unlock them, functioning as ransomware.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“This is a typical ransomware message”
WannaCry USES EternalBlue
WannaCry used the EternalBlue exploit.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“The exploit this malware was using was EternalBlue”
WannaCry USES DoublePulsar
Matt Suiche said the malware was using DoublePulsar together with EternalBlue.
Explicit Confidence 98% · Matt Suiche EP 73 Details
“it was using the DoublePulsar on EternalBlue”
WannaCry USES self-propagating worm
WannaCry was a self-propagating worm that attempted to infect other computers on a local network.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“this ransomware was a self-propagating worm”
WannaCry USES lateral movement
After infecting one computer, WannaCry attempted to spread to other computers inside the local network.
Explicit Confidence 98% · Jack Rhysider EP 73 Details
“it would then look to try to infect every other computer in that local network”
WannaCry USES kill switch
WannaCry checked a specific URL and stopped running when the URL was active, implementing a kill switch.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“This is called a kill switch”
EternalBlue EXPLOITS SMB vulnerability
EternalBlue exploited a serious vulnerability in the way Windows file sharing through SMB works.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“It was a very serious vulnerability which exploited the way Windows file sharing works, or SMB”
EternalBlue AFFECTS SMB
The exploit affected SMB, the Windows file-sharing protocol.
Explicit Confidence 98% · Jack Rhysider EP 73 Details
“the way Windows file sharing works, or SMB”
EternalBlue DEVELOPED_BY NSA
Jack states that EternalBlue was created by the NSA, though the episode presents this as part of a chain of events rather than independently documented evidence.
Explicit Confidence 86% · Jack Rhysider EP 73 Details
“Shadow Brokers wouldn’t have released EternalBlue if it wasn’t for the NSA creating it to begin with”
WannaCry DISCOVERED_BY Marcus Hutchins
Marcus Hutchins discovered the kill-switch URL and its behavior while analyzing WannaCry.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“when Marcus Hutchins found this URL in the code”
WannaCry ATTRIBUTED_TO Park Jin Hyok
The U.S. Department of Justice charged Park Jin Hyok in connection with a conspiracy that included creating the WannaCry ransomware.
Attributed Confidence 98% · Doj EP 73 Details
“creating the WannaCry ransomware”
WannaCry ATTRIBUTED_TO North Korea
The U.S. Department of Justice attributed the broader cyber-attack conspiracy, including WannaCry, to actors operating on behalf of the North Korean government.
Attributed Confidence 97% · Doj EP 73 Details
“a conspiracy that conducted sophisticated cyber-attacks around the world on behalf of the North Korean government”
Kim Hyon Woo POSSIBLY_SAME_AS Park Jin Hyok
The DOJ reportedly had enough evidence to believe Kim Hyon Woo was an alias of Park Jin Hyok; the episode therefore presents the identity link as an evidentiary conclusion rather than an independently certain fact.
Uncertain Confidence 96% · Jack Rhysider EP 73 Details
“The DOJ saw enough evidence to believe that Kim Hyon Woo was an alias of Park Jin Hyok”
Bureau 121 PART_OF Reconnaissance General Bureau
Bureau 121 is described as a branch within North Korea's Reconnaissance General Bureau.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“within the Reconnaissance General Bureau is another branch called Bureau 121”
Lazarus Group ASSOCIATED_WITH Bureau 121
The episode says security-community observers call the North Korean hackers the Lazarus Group and that those hackers are believed to work from Bureau 121.
Uncertain Confidence 90% · Jack Rhysider EP 73 Details
“Bureau 121 is where we believe North Korean hackers are working from. People in the security community call the North Korean hackers The Lazarus Group”
Lazarus Group TARGETS South Korea
The episode says North Korean hackers, identified in context with the Lazarus Group, appear to target South Korea.
Uncertain Confidence 88% · Jack Rhysider EP 73 Details
“North Korean’s main attack targets seem to be South Korea”
Lazarus Group TARGETS Japan
The episode says North Korean hackers, identified in context with the Lazarus Group, appear to target Japan.
Uncertain Confidence 88% · Jack Rhysider EP 73 Details
“North Korean’s main attack targets seem to be South Korea, Japan”
Lazarus Group TARGETS United States
The episode says North Korean hackers, identified in context with the Lazarus Group, appear to target the United States.
Uncertain Confidence 88% · Jack Rhysider EP 73 Details
“North Korean’s main attack targets seem to be South Korea, Japan, and the United States”
Sony Pictures ATTRIBUTED_TO Lazarus Group
A European Union report is said to attribute the Sony attack to the Lazarus Group.
Attributed Confidence 93% · Jack Rhysider EP 73 Details
“the Lazarus Group is who carried out the attacks on Sony”
Bangladesh Bank ATTRIBUTED_TO Lazarus Group
A European Union report is said to attribute the Bangladesh Bank heist to the Lazarus Group.
Attributed Confidence 93% · Jack Rhysider EP 73 Details
“did the Bangladesh Bank heist”
WannaCry ATTRIBUTED_TO Lazarus Group
A European Union report is said to attribute WannaCry to the Lazarus Group.
Attributed Confidence 93% · Jack Rhysider EP 73 Details
“and conducted WannaCry”
NotPetya USES EternalBlue
The episode says NotPetya also used EternalBlue.
Explicit Confidence 98% · Jack Rhysider EP 73 Details
“in June, is when NotPetya hit Ukraine which also used EternalBlue”
The NotPetya incident involved the NotPetya malware.
Explicit Confidence 98% · Jack Rhysider EP 73 Details
“when NotPetya hit Ukraine”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:36:57.012262+00:00