wannacry

WannaCry was a devastating ransomware worm that emerged in May 2017, causing one of the most widespread cyberattacks in history with financial motivations, though its global impact suggested possible nation-state connections. The attack has been attributed by U.S. and UK authorities to the Lazarus Group, a North Korean state-sponsored hacking organization, operating independently rather than as a ransomware-as-a-service model. WannaCry utilized the EternalBlue exploit, allegedly developed by the NSA and leaked by the Shadow Brokers, to propagate through networks by targeting a vulnerability in Microsoft's Server Message Block protocol, encrypting files with AES-128 encryption and demanding Bitcoin payments while spreading automatically across networks without user interaction. The ransomware infected an estimated 300,000 computers across 150 countries within days, notably crippling the UK's National Health Service, disrupting operations at major companies like FedEx and Renault, and affecting critical infrastructure globally before being slowed by a security researcher's discovery of a kill switch domain. WannaCry is considered largely inactive as an ongoing threat following the initial outbreak, though variants and copycat attacks have occasionally emerged.