--- title: "What You Need To Know About The WannaCry Ransomware Worm" type: "post" post_id: "14625" slug: "what-you-need-to-know-about-the-wannacry-ransomware-worm" canonical: "https://easydns.com/blog/2017/05/15/what-you-need-to-know-about-the-wannacry-ransomware-worm/" markdown_url: "https://easydns.com/blog/2017/05/15/what-you-need-to-know-about-the-wannacry-ransomware-worm.md" json_url: "https://easydns.com/blog/2017/05/15/what-you-need-to-know-about-the-wannacry-ransomware-worm.json" txt_url: "https://easydns.com/blog/2017/05/15/what-you-need-to-know-about-the-wannacry-ransomware-worm.txt" published: "2017-05-15T14:08:05+00:00" modified: "2024-11-13T16:57:20+00:00" author: "easydnssupport" categories: - "#AxisOfEasy" tags: - "Doublepulsar" - "EternalBlue" - "NSA" - "Shadow Brokers" - "WanaCry" - "WannaCrypt0r" site_name: "easyDNS" publisher: "" language: "en-US" generator: "easyPress Markdown" generator_version: "1.0.3" --- ![](https://www.easydns.com/wp-content/uploads/2017/05/wannacry-ransomeware-building-1024x768.jpeg) This week’s #AxisOfEasy had a few topics lined up, such as comedian John Oliver’s epic rant about net neutrality [crashing the web servers of the U.S FCC (again)](https://arstechnica.com/tech-policy/2017/05/john-oliver-tackles-net-neutrality-again-crashes-fcc-comments-site-again/), but forget all that. Everything has taken a back seat to the WanaCrypt0r (a.k.a “WanaCry”, or “WannaCrypt”) Ransomware Worm. WanaCry broke out overnight May 11th and quickly became the biggest ransomware attack in history. (Ransomware is malicious software which infects your computer or server and encrypts all your files until the victim remits a “ransom”, usually paid via bitcoin, to obtain the decryption key). What makes WanaCry different from previous ransomware attacks is that it is a worm, where until now ransomware was typically delivered via email phishing and malware delivery. Let’s get started. *“The future is already here. It’s just unevenly distributed” — William Gibson* In this issue: - WannaCry Worm leverages previously leaked NSA exploit kit - Worm stopped when researcher discovered a domain name “killswitch” - New variants already appearing - What you can do about it **WannaCry Worm leverages previously leaked NSA exploit kit** The [May 1st edition of #AxisOfEasy talked about DoublePulsar](https://www.easydns.com/blog/2017/05/02/doublepulsar-the-leaked-nsa-exploit-kit-spreading-in-the-wild/) the NSA exploit kit leaked by the Shadow Brokers and how it was being used to create new attacks that were infecting unpatched Windows IIS servers. A part of that leaked framework (called EternalBlue) has now been used to create a ransomware “worm”, the first of it’s kind, to infect those same types of vulnerable Microsoft servers (using a weakness in the Windows SMB service). The worm [broke out overnight May 11](https://blog.avast.com/ransomware-that-infected-telefonica-and-nhs-hospitals-is-spreading-aggressively-with-over-50000-attacks-so-far-today) and quickly infected upwards of 50,000 to 100,000 hosts going into the weekend, affecting telecoms, hospitals, rail services and numerous other corporate systems. Microsoft had already released a patch to specifically address the DoublePulsar leak, they have now issued guidance ([here](https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/), and [here](https://blogs.technet.microsoft.com/mmpc/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/)), including another emergency patch in the wake of the worm. **Worm stopped when researcher discovered a domain name “killswitch”** While WanaCry infections were concentrated in Europe, [over 100 countries reported incidents within the first 24 hours](https://intel.malwaretech.com/botnet/wcrypt). The worm was on track to spread even more virulently until a security researcher known only by the handle “MalwareTech” [discovered a “killswitch” in the code](https://www.theguardian.com/technology/2017/may/13/accidental-hero-finds-kill-switch-to-stop-spread-of-ransomware-cyber-attack) which would stop the worm from spreading. That killswitch was in the form of a non-existent domain name. Instances of the worm would check if it existed, if not they would continue to propagate themselves wherever possible. However if they found that the domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\[dot\]com) *did* exist, they would stop spreading. The researcher promptly registered this killswitch domain, thus causing the spread to stop – for the time being. Events further took on a resemblance to a futuristic cyberpunk novella when parties unknown fired up a Mirai botnet (that’s the [IoT device botnet that caused the mother of all DNS outages back in October](https://www.easydns.com/blog/2016/10/24/the-dns-attack-what-it-means-who-did-it-and-how-to-deal)) and DDoSed the killswitch domain in an effort to *kill the killswitch* so that the worm could continue its spread. It is posited that the appearance of new variants without such a killswitch is only a matter of time. **New variants already appearing** At least two variants have already appeared over the weekend: - one containing another killswitch simply consisting of some other random looking domain, which was duly registered by security researchers again, - another containing *no* killswitch, but other faulty coding has prevented it from enacting the encryption component of it’s ransomware payload. **Not to be confused with the “Jaff” ransomware, which is just as bad** As dramatic as this past weekend’s events have been, this type of thing has been going on for years and it’s not limited in scope to Microsoft servers, it frequently comes in via email and targets many and all system types. For example, over the weekend another ransomware variant, [called “Jaff”](https://threatpost.com/new-jaff-ransomware-part-of-active-necurs-spam-blitz/125648/) did spread via email. It uses the same executable name as WanaCry, further confusing security researchers efforts. Any media reports stating that Wanacry was spreading via email spearphishing attacks are almost certainly mistakenly referring to the “Jaff” ransomware. Jaff” emails have PDF attachments with embedded Microsoft Word docs containing hostile macros which connect to remote URLs that initiate the ransomware download and infection sequence. Subject lines lately are typically about “Invoices”: `

Subject: 27_Invoice_9018` **What you can do about it** If you’re running a Windows IIS server, make sure you’re up on patches and read the aforementioned Microsoft guidance. If you aren’t already backing up your systems, you should seriously do that. (At the risk of veering into infomercial territory, we are working on “easyBackup”, should be ready this summer). If you are already running backups, run more backups. Run antivirus and malware protection, I use Sophos, Bitdefender and ClamAV. If I ever get an unrecognized attachment that gets through our virus filters, blackholes, and my own computer’s antivirus systems that I think I need to open I also run it through [Virustotal](https://www.virustotal.com), a handy online scanning tool that let’s you scan a specific single file. **Previously on #AxisOfEasy** If you missed the previous issues, they can be read online here: - [May 8, 2017: Facebook Ads Targeting Teens Based on Emotional State](https://www.easydns.com/blog/2017/05/08/facebook-ads-targeting-teens-based-on-emotional-state/) - [May 1, 2017: DoublePulsar: The Leaked NSA Exploit Kit Spreading In the Wild](https://www.easydns.com/blog/2017/05/02/doublepulsar-the-leaked-nsa-exploit-kit-spreading-in-the-wild/) - [April 24, 2017: Is Google Stealing Your Content?](https://www.easydns.com/blog/2017/04/24/is-google-stealing-your-content/)