Skip to main content
Darkfield

Operator dossier

wannacry (also tracked as WannaCrypt, WanaCrypt0r, WCrypt, WCRY) is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 33 public victims claimed by this operator between May 12, 2017 and February 23, 2018. WannaCry was a devastating ransomware worm that emerged in May 2017, causing one of the most widespread cyberattacks in history with financial motivations, though its global impact suggested possible nation-state connections. The attack has been attributed by U.S. and UK authorities to the Lazarus Group, a North Korean state-sponsored hacking organization, operating independently rather than as a ransomware-as-a-service model. WannaCry utilized the EternalBlue exploit, allegedly developed by the NSA and leaked by the Shadow Brokers, to propagate through networks by targeting a vulnerability in Microsoft's Server Message Block protocol, encrypting files with AES-128 encryption and demanding Bitcoin payments while spreading automatically across networks without user interaction. The ransomware infected an estimated 300,000 computers across 150 countries within days, notably crippling the UK's National Health Service, disrupting operations at major companies like FedEx and Renault, and affecting critical infrastructure globally before being slowed by a security researcher's discovery of a kill switch domain. WannaCry is considered largely inactive as an ongoing threat following the initial outbreak, though variants and copycat attacks have occasionally emerged.

Most-targeted sectors

Most-affected countries

Recent disclosures by wannacry

All 33 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for wannacry →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

wannacry

aka WannaCrypt, WanaCrypt0r, WCrypt, WCRY · 33 victims indexed · first seen 9 years ago · last activity 8 years ago

33
Victims indexed
#136 of 364 tracked operators
9m
Active period
May 2017 → Feb 2018
10
Countries hit
top US · 6

At a glance

Status
inactive
Aliases
WannaCrypt, WanaCrypt0r, WCrypt, WCRY
First seen
9 years ago
Last activity
8 years ago
Primary sector
Government Facilities · 7 hits

About

WannaCry was a devastating ransomware worm that emerged in May 2017, causing one of the most widespread cyberattacks in history with financial motivations, though its global impact suggested possible nation-state connections. The attack has been attributed by U.S. and UK authorities to the Lazarus Group, a North Korean state-sponsored hacking organization, operating independently rather than as a ransomware-as-a-service model. WannaCry utilized the EternalBlue exploit, allegedly developed by the NSA and leaked by the Shadow Brokers, to propagate through networks by targeting a vulnerability in Microsoft's Server Message Block protocol, encrypting files with AES-128 encryption and demanding Bitcoin payments while spreading automatically across networks without user interaction. The ransomware infected an estimated 300,000 computers across 150 countries within days, notably crippling the UK's National Health Service, disrupting operations at major companies like FedEx and Renault, and affecting critical infrastructure globally before being slowed by a security researcher's discovery of a kill switch domain. WannaCry is considered largely inactive as an ongoing threat following the initial outbreak, though variants and copycat attacks have occasionally emerged.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

5 months
2017-05-01T00:00:00+00:00 · 292017-06-01T00:00:00+00:00 · 12017-07-01T00:00:00+00:00 · 12017-08-01T00:00:00+00:00 · 12018-02-01T00:00:00+00:00 · 1
2017-05-01T00:00:00+00:002018-02-01T00:00:00+00:00

Top countries

🇺🇸 United States
6
🇨🇳 China
4
🇧🇷 Brazil
3
🇷🇺 Russia
3
🇬🇧 United Kingdom
2
🇸🇬 Singapore
2
🇪🇸 Spain
2
🇸🇪 Sweden
1
United States dossier →China dossier →Brazil dossier →Russia dossier →

Top sectors

Government Facilities
7
Communication
5
Commercial Facilities
4
Financial
3
Emergency Services
3
Transportation Systems
3
Energy
3
Critical Manufacturing
2
Government Facilities dossier →Communication dossier →Commercial Facilities dossier →Financial dossier →

MITRE ATT&CK

4 techniques · 4 tactics

Tactics

Initial AccessExecutionLateral MovementImpact

Techniques

  • T1190Exploit Public-Facing Application
  • T1203Exploitation for Client Execution
  • T1210Exploitation of Remote Services
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Source

Updated 8 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time wannacry posts a victim.

Add wannacry to your watchlist — Pro pings you within 5 minutes of any new wannacry leak-site post, Telegram callout, or affiliate-rebrand inference.