WannaCry: The Worm That Broke the World

On the morning of Friday, May 12, 2017, something strange began happening inside the networks of the British National Health Service. Computers at NHS trusts across England and Scotland began displaying a red and black pop-up window where medical records software used to be. The message was blunt:

“Ooops, your files have been encrypted!”

Staff tried to dismiss the window. It would not close. They tried to log into other machines. The same message. Systems administrators began pulling network cables in a panic. Operating theatres cancelled procedures. Ambulances were diverted from hospitals that could no longer process patients. GPs couldn’t access patient records. Nurses resorted to pen and paper.

This was not a targeted attack on healthcare. The NHS was collateral damage.

WannaCry — a self-propagating cryptoworm armed with the stolen arsenal of the United States National Security Agency — was tearing through the world’s internet infrastructure at a speed no one had ever witnessed. Within four days, it would infect over 200,000 systems in 150 countries, causing an estimated $4–8 billion in damages, and come within a single domain registration of becoming something far, far worse.

Threat Actor Profile: Lazarus Group (Bureau 121)

Designation: Lazarus Group (Mandiant); Hidden Cobra (US Government); Zinc (Microsoft); APT38 (financial operations subgroup) Attribution: Democratic People’s Republic of Korea; Reconnaissance General Bureau, Bureau 121 Origin: Pyongyang, North Korea; operating since at least 2009 Primary Mission: A uniquely dual-purpose threat actor — conducting both state-directed geopolitical destruction and financially motivated cybercrime to fund North Korea’s sanctioned weapons and nuclear programs Known Tradecraft: Wiper malware, cryptoworms, cryptocurrency theft, SWIFT system exploitation, supply chain compromise, long-dwell espionage

Notorious Operations:

• Sony Pictures (2014): Destructive wiper attack against a US entertainment company over a satirical film; exfiltrated and published tens of thousands of internal emails and employee records.
• Bangladesh Bank SWIFT Heist (2016): The most audacious bank robbery in history — $81 million stolen from the Bangladesh Central Bank’s Federal Reserve account via compromised SWIFT messaging infrastructure. A spelling error prevented an additional $870 million from being transferred.
• WannaCry (2017): Global cryptoworm using NSA-developed exploits; the most geographically widespread ransomware outbreak ever recorded.
• Cryptocurrency Exchange Attacks (2017–present): Over $3 billion stolen from exchanges, DeFi protocols, and developer social engineering operations — functioning as a direct hard-currency revenue stream for North Korea’s state programs.
• 3CX Supply Chain Attack (2023): Sophisticated compromise of a VoIP software provider’s build pipeline, echoing SolarWinds in method.

The Ammunition: How the NSA Lost Its Weapons

To understand WannaCry, you must first understand EternalBlue.

EternalBlue was an exploit developed by the NSA’s Equation Group — the agency’s elite offensive cyber unit — to target a critical vulnerability in Microsoft’s Server Message Block (SMB) protocol, specifically in Windows’ implementation of SMBv1. SMB is the protocol that Windows machines use to share files, printers, and other resources across a network. The vulnerability, tracked as CVE-2017-0144, allowed an attacker to send a specially crafted packet to a machine on port 445 and achieve remote code execution with no user interaction, no credentials, and no warning.

The NSA had weaponized this into a tool capable of silently compromising any unpatched Windows machine reachable on a network. They used it. They kept it secret.

Then, in August 2016, a shadowy entity calling itself The Shadow Brokers appeared online and claimed to have stolen a trove of NSA cyberweapons. Over the following months, they taunted the intelligence community, releasing small samples as proof. The security world was transfixed.

On April 14, 2017 — less than a month before WannaCry — The Shadow Brokers released the full dump. Among the contents: EternalBlue, along with a companion backdoor called DoublePulsar, and several other weaponized NSA exploits.

Microsoft had been quietly notified of the vulnerability in March 2017 and had released a patch (MS17-010) weeks before the leak. But hundreds of millions of Windows machines worldwide remained unpatched. Many were running Windows 7 or Windows XP — systems for which automatic updates were disabled, impractical, or simply ignored.

The weapons were in the wild. The timer was running.

The Weapon: WannaCry’s Architecture

WannaCry was not merely ransomware. It was a cryptoworm — a piece of malware that combines ransomware’s extortion payload with a worm’s self-replicating propagation engine. Most ransomware in 2017 required a victim to click a phishing link or open a malicious attachment. WannaCry needed nothing from the victim at all.

The worm’s architecture was devastatingly efficient:

Propagation Engine: Upon executing on an initial host, WannaCry immediately began scanning both the local network subnet and random IP addresses across the public internet for machines with port 445 open. For each target found, it fired the EternalBlue exploit. If the exploit succeeded, WannaCry installed the DoublePulsar backdoor kernel implant, then used that backdoor to deploy a copy of itself. The new copy immediately began scanning from its new host.

The Kill Switch: Inside WannaCry’s code, security researcher Marcus Hutchins (online handle: MalwareTech) — a 22-year-old working from his bedroom in Ilfracombe, England — noticed something unusual during analysis. Before executing its ransomware payload, the worm made a DNS lookup to an extraordinarily long, nonsensical domain name:

iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

If the domain resolved (returned any response), WannaCry would terminate itself. If the domain was unreachable, it would proceed to encrypt. The domain did not exist. Hutchins, curious, registered it for $10.69.

The effect was immediate: hundreds of thousands of WannaCry instances phoned home to the newly live domain, received a response, and shut down. The spread stopped cold.

Hutchins had accidentally discovered — and activated — the worm’s kill switch.

The Ransomware Payload: On systems where the kill switch did not apply (isolated networks where the domain lookup couldn’t reach the internet), WannaCry encrypted the victim’s files using AES-128 symmetric encryption, with the key itself encrypted under an RSA-2048 keypair whose private component was held only by the attackers. Victims were presented with a demand for $300–600 worth of Bitcoin, delivered to three hardcoded Bitcoin wallet addresses.

The extortion mechanism was crude: WannaCry used three shared wallets with no mechanism to match payments to victims and provide decryption keys. Even victims who paid had no reliable way to recover files. The operators collected approximately $130,000 in ransom — a pittance relative to the devastation inflicted.

This was a tell: WannaCry was not optimized for profit. It was optimized for destruction.

The Targets: A World in Flames

The scale of the outbreak made headlines within hours. By evening of May 12, it had become clear that this was something fundamentally different from anything the security community had seen before:

• National Health Service (UK): The most visible victim. Approximately one-third of NHS trusts in England were affected — 19,000 appointments cancelled, surgeries postponed including cancer procedures, ambulances diverted. Staff hand-wrote records. The NHS’s failure to patch ageing Windows machines was a years-long institutional failure; WannaCry collected the bill.
• Telefónica (Spain): The telecommunications giant lost large portions of its internal network. Employees were told to shut down computers and not come in.
• Deutsche Bahn (Germany): Train departure boards across Germany displayed only the ransom message. Ticket machines went offline.
• FedEx (United States): TNT Express, FedEx’s European subsidiary, suffered widespread disruption that took months to fully recover from.
• Nissan and Renault: Production lines at multiple automobile manufacturing plants were halted.
• Russia: Despite attribution pointing to a Russian-allied North Korea, Russia was among the hardest-hit countries — Sberbank, the Ministry of Internal Affairs, and Russian Railways were all affected. WannaCry did not distinguish between allies and enemies.

Attribution: Pyongyang’s Fingerprints

Attribution did not happen overnight. The crude extortion mechanism and lack of clear geopolitical targeting led many researchers to question whether WannaCry was state-sponsored at all.

The fingerprints emerged gradually:

Code Overlap: Researchers at Symantec and Google’s Project Zero identified significant code similarities between WannaCry’s backdoor components and tools previously used exclusively by Lazarus Group — including code identical to portions of Contopee, a Lazarus backdoor used in attacks against financial institutions in Southeast Asia.

Infrastructure Overlap: Command-and-control infrastructure used in WannaCry’s earliest test versions shared IP addresses and hosting patterns with previously documented Lazarus operations.

Google’s Neal Mehta was among the first to publicly note the similarities; the attribution was refined and strengthened over subsequent months of analysis by multiple independent research teams.

In December 2017, the White House formally attributed WannaCry to North Korea. The UK’s National Cyber Security Centre and Australia’s Australian Cyber Security Centre followed suit. In September 2018, the US Department of Justice indicted North Korean programmer Park Jin Hyok for his alleged role in WannaCry, the Sony Pictures attack, and the Bangladesh Bank heist.

The NSA’s own internal attribution, reportedly made within days of the outbreak, had pointed to Lazarus Group almost immediately — years of tracking the group’s infrastructure, code signatures, and operational patterns meant the fingerprints were immediately recognizable.

The Legacy: A World Changed

WannaCry forced a reckoning that the security industry had been deferring for years.

For Microsoft, the embarrassment of having its protocol weaponized with an NSA exploit prompted an extraordinary step: the company released emergency patches for Windows XP and Windows Server 2003 — operating systems that had been officially end-of-life for years — to prevent further spread. Microsoft’s president Brad Smith publicly called out the NSA’s practice of stockpiling vulnerabilities as equivalent to “the US military having some of its Tomahawk missiles stolen.”

For governments, WannaCry demonstrated that the practice of nation-state vulnerability hoarding — keeping powerful exploits secret rather than reporting them to vendors for patching — created systemic risks. An exploit powerful enough to be used as a weapon is powerful enough to become a weapon in the wrong hands. The Shadow Brokers leak turned theory into catastrophe.

For healthcare systems globally, WannaCry was a galvanizing moment. The NHS began a multi-hundred-million-pound programme to replace end-of-life Windows systems and implement network segmentation. Healthcare cybersecurity, once a backwater concern, became a boardroom priority.

For Marcus Hutchins, the kill switch discovery made him an overnight hero — recognized by the UK government, celebrated globally. Seven weeks later, US authorities arrested him at a Las Vegas airport as he was departing DEF CON, on unrelated charges related to earlier work creating banking malware as a teenager. He would later plead guilty, receive time served, and return to full-time security research. His story is the peculiar shape of this industry: the same mind that stopped a global catastrophe had, years earlier, helped build a smaller one.

---

Attack Chain: WannaCry Cryptoworm

graph TD
    A["🇰🇵 Lazarus Group\n(DPRK Bureau 121)"] --> B["Acquisition of EternalBlue\n+ DoublePulsar\n(NSA tools leaked by Shadow Brokers\nApril 14, 2017)"]

    B --> C["WannaCry Cryptoworm\nDevelopment & Weaponization\nEternalBlue + DoublePulsar +\nRansomware Payload + Kill Switch"]

    C --> D["Initial Infections\nMay 12, 2017\n~07:44 UTC\nAsia-Pacific first hit"]

    D --> E["Propagation Engine"]
    E --> E1["Scan Local Network\nPort 445 (SMBv1)"]
    E --> E2["Scan Random Public IPs\nPort 445 (SMBv1)"]

    E1 --> F["Fire EternalBlue Exploit\nCVE-2017-0144\nSMBv1 Buffer Overflow\nZero User Interaction"]
    E2 --> F

    F --> G{"Target Patched?\n(MS17-010)"}
    G -->|"No — unpatched"| H["EternalBlue Succeeds\nRemote Code Execution"]
    G -->|"Yes — patched"| I["Exploit Fails\nMove to Next Target"]

    H --> J["Install DoublePulsar\nKernel-level Backdoor Implant"]
    J --> K["Deploy WannaCry Copy\nvia DoublePulsar"]
    K --> E

    H --> L{"Kill Switch Check\nDNS Lookup:\niuqerfsodp9i...com"}
    L -->|"Domain resolves\n(after Hutchins registers it)"| M["WannaCry Terminates\n✅ Kill Switch Activated"]
    L -->|"Domain unreachable\n(isolated networks)"| N["Ransomware Payload\nExecutes"]

    N --> O["File Encryption\nAES-128 + RSA-2048\nAll user files locked"]
    O --> P["Ransom Demand\n$300–600 in Bitcoin\n3 Shared Wallets"]

    P --> Q["🏥 NHS UK\n19,000 appointments cancelled\nSurgeries postponed"]
    P --> R["📡 Telefónica (Spain)\nInternal network crippled"]
    P --> S["🚂 Deutsche Bahn\nDeparture boards compromised"]
    P --> T["📦 FedEx / TNT\nMonths of disruption"]

    M --> U["🛑 Global Spread Halted\nMarcus Hutchins / MalwareTech\n$10.69 domain registration"]

    Q --> V["200,000+ Systems\n150 Countries\n4 Days"]
    V --> W["$4–8 Billion\nEstimated Global Damage"]

    V --> X["Attribution: Lazarus Group\nSymantec + Google code analysis\nWhite House attribution Dec 2017"]
    X --> Y["DOJ Indictment:\nPark Jin Hyok (Sept 2018)"]

    W --> Z["Microsoft Emergency Patch\nWindows XP + Server 2003\n(End-of-Life Systems)"]
    W --> AA["Brad Smith (Microsoft):\n'NSA Tomahawk missile' speech\nVulnerability hoarding indictment"]