Search threats, CVEs… ⌘K

← Back to all threat actors

wannacry

WannaCry ransomware is a cyber attack that spreads by exploiting vulnerabilities in the Windows operating system. At its peak in May 2017, WannaCry became a global threat. Cybercriminals used the ransomware to hold an organization's data hostage and extort money in the form of cryptocurrency. WannaCry spreads using EternalBlue, an exploit leaked from the National Security Agency (NSA). EternalBlue enables attackers to use a zero-day vulnerability to gain access to a system. It targets Windows computers that use a legacy version of the Server Message Block (SMB) protocol.

How we source and review actor profiles

Motivation

ransomware

First seen

2017-05-12

Last seen

2018-02-23

Sectors

public-sector, telecommunication, manufacturing, transportation-logistics, energy, financial-services, consumer-services, education, healthcare

Status

Dormant

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

2018-02-23Claimed

Victim claimState of Connecticut (12 State Agencies, including the Department of Administrative Services) listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-08-16Claimed

Victim claimBecker County listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-07-01Claimed

Victim claimMurfreesboro PD and FD listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-06-19Claimed

Victim claimHonda Motor Co. listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-16Claimed

Victim claimTelkom listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-15Claimed

Victim claimRensselaer County Library listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimBank Of China listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimMegaFon listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimSberbank listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimThailand Digital Billboard listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimMediaOnline listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimChinese traffic police, immigration and public security bureaus listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimBrazil's social security system listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimBrazil's Foreign Ministry listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimPetrobras listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimNational Health Service (NHS) UK listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimNissan listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimChinese Police listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimChina gas stations listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimDeutsche Bahn (Germany Rail Network) listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimIberdrola listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimTelefonica listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimRenault listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimIndian police in the state of Andhra Pradesh listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

2017-05-12Claimed

Victim claimHitachi listed by wannacry

Actor-claimed victim evidence. This listing is not independent confirmation of compromise.

Actor Claimed

The interactive view includes 33 dated events with category filters and paging.

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

wannacryCanonical Name

Loading CVEs, techniques, indicators, malware, victims, and activity...