WannaCry was a devastating ransomware worm that emerged in May 2017, causing one of the most widespread cyberattacks in history with financial motivations, though its global impact suggested possible nation-state connections. The attack has been attributed by U.S. and UK authorities to the Lazarus Group, a North Korean state-sponsored hacking organization, operating independently rather than as a ransomware-as-a-service model. WannaCry utilized the EternalBlue exploit, allegedly developed by the NSA and leaked by the Shadow Brokers, to propagate through networks by targeting a vulnerability in Microsoft's Server Message Block protocol, encrypting files with AES-128 encryption and demanding Bitcoin payments while spreading automatically across networks without user interaction. The ransomware infected an estimated 300,000 computers across 150 countries within days, notably crippling the UK's National Health Service, disrupting operations at major companies like FedEx and Renault, and affecting critical infrastructure globally before being slowed by a security researcher's discovery of a kill switch domain. WannaCry is considered largely inactive as an ongoing threat following the initial outbreak, though variants and copycat attacks have occasionally emerged. The group has been linked to 33 public disclosures across our corpus. First observed on a leak site on May 12, 2017; most recent post February 23, 2018. The operation is currently inactive.
Also tracked as: WannaCrypt, WanaCrypt0r, WCrypt, WCRY.
Sector and geography
This disclosure adds to ransomware activity in the Government Facilities sector, which has 84 disclosures indexed across all operators we track. Geographically, Chinese traffic police, immigration and public security bureaus is reported in China, a country with 29 ransomware disclosures in our corpus.
How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.
