{"id":1944,"date":"2017-06-13T02:11:48","date_gmt":"2017-06-13T08:11:48","guid":{"rendered":"https:\/\/www.supportpro.com\/blog\/?p=1944"},"modified":"2026-06-19T04:51:38","modified_gmt":"2026-06-19T10:51:38","slug":"secure-from-wannacry-ransomware","status":"publish","type":"post","link":"https:\/\/www.supportpro.com\/blog\/secure-from-wannacry-ransomware\/","title":{"rendered":"WannaCry Ransomware: Understanding the Threat and How to Stay Protected"},"content":{"rendered":"

Introduction<\/span><\/h1>\n

It was on May 12th, 2017, that the world saw one of the biggest cyberattacks in internet history: the WannaCry ransomware attack. Within hours, the malware spread to hundreds of thousands of computers in over 150 countries. It disrupted businesses, government agencies, healthcare services, and essential infrastructure. WannaCry exploited a flaw in Microsoft Windows systems to encrypt users’ files and demanded a ransom for their release. This attack served as a wake-up call for both organizations and individuals. It showed how crucial timely security updates, data backups, and proactive cybersecurity practices are. In this article, we will look at how WannaCry works, who is at risk, and the main steps you can take to protect your Windows systems from ransomware threats.<\/span><\/p>\n

What is Ransomware?<\/strong><\/h2>\n

A cyberattack in which hackers gain control of a computer system, tablet, or smartphone and then demand a ransom to unlock it.<\/p>\n

To gain access to the system, the cybercriminal needs to download a type of malicious software onto a device within the network, often by getting a victim to click a link or download it by mistake. Once the software evades detection on the computer, it encrypts the files and displays a pop-up with a countdown and instructions for paying the ransom to decrypt and recover the original files.<\/p>\n

Payment is only accepted in Bitcoin. The hacker demands a payment of around $300 in Bitcoin within three days or $600 within seven days. If not paid, the hacker threatens to permanently wipe all the user’s data.<\/p>\n

The Classes<\/strong><\/h3>\n

Encryptors, using advanced encryption algorithms, block system files and demand payment for the decryption key to decrypt the blocked content, namely Crypto Locker, Locky, and CryptoWall.<\/p>\n

Lockers, in turn, lock the victim’s operating environment, making it impossible to access the desktop, apps, or files. The files are not actually encrypted in this case, but the invaders demand a ransom to unblock the compromised system, namely Winlocker.<\/p>\n

How do ransomware infections happen?<\/strong><\/h2>\n

Though the infection phases differ on each ransomware attack, the important stages are as follows:<\/p>\n

The victim may receive an email containing a malicious URL. It is also possible for the infection to originate from a defamatory website. When the victims click\/download the link and opens the attachment, a downloader gets placed on the system. This employs a list of domains or C&C servers administered by cybercriminals to download the ransomware onto the machine. This malware encrypts the entire contents of the hard drive, personal documents, and any sensitive information, including data stored in Cloud accounts synced on your system. It also encrypts data on other machines within the local network.<\/p>\n

A warning then pops up with the necessary information for decrypting the files.<\/p>\n

\"ransomware_wannacry\"<\/a><\/p>\n

The Wannacry Attack<\/strong><\/h2>\n

On Friday, May 12, 2017, a Ransomware attack was launched, spreading WannaCry worldwide. It exploited a vulnerability in Microsoft Windows, allowing it to infect systems without the victims taking any action. It was estimated that by May 24, 2017, the infection had affected over 200,000 systems in over 150 countries, and it kept going.<\/p>\n

The program, which was deployed and named \u201cWannaCry\u201d, asks for a minimum price of about $300, but the longer you wait to pay, the more the price increases. This took advantage of a Windows loophole, which was unearthed by the U.S. National Security Agency (NSA) & later exposed to the world by hackers.<\/p>\n

Who\u2019s most vulnerable?<\/strong><\/h2>\n

WannaCry ransomware targets Microsoft’s widely used Windows operating systems. PC’s\u00a0with Windows OS that are not running updated software are the most at risk. All versions of Windows before Windows 10 are vulnerable to this attack if not patched for MS-17-010.<\/p>\n

Ransomware gets into your computer, either by clicking or downloading malicious files. The malware then spreads quickly through file-sharing systems. It can also spread through a network by exploiting a vulnerability in the Server Message Block (SMB) protocol.<\/p>\n

How does WannaCry work?<\/strong><\/h2>\n

WannaCry uses the ETERNALBLUE exploit, which exploits a loophole in Microsoft’s Server Message Block protocol; it will spread to any connected systems that have not been updated to guard against ETERNALBLUE. Once it gets infected, it encrypts images, databases, office files, email files, and movies, and demands a ransom. It also installs DoublePulsar, a backdoor implant tool.<\/p>\n

How to be safe?<\/strong><\/h2>\n

The foremost thing is to keep your Windows system up to date. For that, go to the Start menu > type “Windows update” into the text prompt > select Windows Update from the results. Then follow the instructions on the screen to update the system.<\/p>\n

For disinfection, Microsoft has already released patches for Windows XP and Windows 8. You just need to choose the correct link for your version of Windows XP or Windows 8. If you are unsure about this, go to the Start menu >> Control Panel >> System. Then the page will appear showing the details of your machine and its Operating System.<\/p>\n

Preventive Steps<\/strong><\/h3>\n

Steps to get secured from upcoming Ransomware attacks:<\/p>\n

Locally, on the PC:<\/p>\n

1. Do not store important data only on your PC.<\/p>\n

2. Have 2 backups of data: one on an external hard drive and one in the Cloud.<\/p>\n

3. Do not turn on applications like OneDrive, Dropbox, Google Drive, etc on your system by default. Open them only once a day for data syncing and close them as soon as this is done.<\/p>\n

4. Update the operating system and the software, including the latest security updates.<\/p>\n

5. Do not use the administrator account on the computer; instead, use a guest account with limited privileges.<\/p>\n

6. SMB will be enabled by default on Windows systems. Disable this service on the system from Settings >> uncheck the settings >> click OK<\/p>\n

7. Install good anti-ransomware software on your machine for better security.<\/p>\n

The Wannacry attack was halted by an information-security professional while analysing the web address in the code. It was discovered that the address used to send the message was unregistered, and after it was registered, the infections suddenly stopped.<\/p>\n

Online behavior<\/strong><\/h3>\n

– Ignore open spam emails or emails from unknown senders.<\/p>\n

– Do not download attachments from spam or suspicious emails.<\/p>\n

– Do not click on the links in spam emails.<\/p>\n

Anti-ransomware security tools<\/strong><\/h2>\n