Skip to Content

The WannaCry Ransomware Attack Could’ve Been a Lot Worse

An accidental discovery brought the initial attack—as well as a feared second wave—grinding to a halt.
NSA headquarters, where software vulnerabilities go to be hoarded in secret ... and then stolen, leaked, and unleashed on an unsuspecting public.

You may have heard: a globe-spanning ransomware attack known as WannaCry (and “WannaCrypt” and “WannaDecryptor”) started on Friday, ultimately encompassing some 200,000 computers in 150 countries.

But it could have been a lot worse—and we have cybersecurity researchers to thank for making sure it wasn’t.

Even as word was still spreading Friday that computers at dozens of hospitals in the U.K. were being maliciously locked down, and a notice demanding ransom posted on their screens, an anonymous researcher known as MalwareTech was in the process of shutting down further spread of the program.

As s/he reported in a fascinating blog post, MalwareTech had found an unregistered URL address in WannaCry’s code. Suspecting that the address had something to do with how the virus communicated—a common feature in botnets and other types of malware—MalwareTech registered the domain and watched as traffic from thousands of infected computers came flooding in, nearly overloading the server hosting the domain. Usually this kind of “sinkhole” move is an effort to disrupt a botnet, for example, from issuing commands to infected systems.

In this case, the domain turned out to be a “kill switch”—on any system that made contact with the URL, the virus shut itself down. WannaCry was on its way out.

As MalwareTech noted, however, malicious programmers could easily alter WannaCry’s code to ping a new address instead. And they did. On Sunday a new variant was infecting thousands of systems in Russia. That, too, was curtailed thanks to the quick work of a cybersecurity researcher.

In the meantime, Microsoft took the unusual step of hustling to distribute a patch for a flaw in the unsupported version of Windows that WannaCry was exploiting. The U.S. National Security Agency had been hoarding the vulnerability, but it was leaked after the theft of the agency’s secrets by a hacking group known as the Shadow Brokers.

Unfortunately, as we’ve stated before, ransomware has become a popular form of cybercrime for one simple reason: it pays. It’s also difficult—though not impossible—to stop. Apart from this weekend’s attacks, criminals have locked down part of San Francisco’s public transit system and a hospital in Los Angeles—in the latter case, forcing the hospital to pony up $17,000 to regain access to its files.

The architects of WannaCry were similarly looking for a quick payday. But they made it pretty easy to follow the money: WannaCry’s code contained the addresses of three Bitcoin wallets. As of midafternoon Monday, a Twitter bot tracking payments to the wallets said the accounts had a total of a little over $55,000 in them.

Thanks to such scrutiny, some experts have speculated that whoever is behind WannaCry won’t dare try to make a withdrawal from the wallets, fearing that it will blow their cover. The sum itself might also give them pause. Sure, it’s a lot of money—but it could’ve been a whole lot more.

(Read more: Malware TechLos Angeles Times, BBC, Quartz, “Holding Data Hostage: The Perfect Internet Crime?,” “Two Ways to Stop Ransomware in Its Tracks”)

Keep Reading

Most Popular

still from Embodied Intelligence video
still from Embodied Intelligence video

These weird virtual creatures evolve their bodies to solve problems

They show how intelligence and body plans are closely linked—and could unlock AI for robots.

pig kidney transplant surgery
pig kidney transplant surgery

Surgeons have successfully tested a pig’s kidney in a human patient

The test, in a brain-dead patient, was very short but represents a milestone in the long quest to use animal organs in human transplants.

conceptual illustration showing various women's faces being scanned
conceptual illustration showing various women's faces being scanned

A horrifying new AI app swaps women into porn videos with a click

Deepfake researchers have long feared the day this would arrive.

thermal image of young woman wearing mask
thermal image of young woman wearing mask

The covid tech that is intimately tied to China’s surveillance state

Heat-sensing cameras and face recognition systems may help fight covid-19—but they also make us complicit in the high-tech oppression of Uyghurs.

Stay connected

Illustration by Rose WongIllustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at with a list of newsletters you’d like to receive.