Skip to Content

The WannaCry Ransomware Attack Could’ve Been a Lot Worse

An accidental discovery brought the initial attack—as well as a feared second wave—grinding to a halt.
NSA headquarters, where software vulnerabilities go to be hoarded in secret ... and then stolen, leaked, and unleashed on an unsuspecting public.

You may have heard: a globe-spanning ransomware attack known as WannaCry (and “WannaCrypt” and “WannaDecryptor”) started on Friday, ultimately encompassing some 200,000 computers in 150 countries.

But it could have been a lot worse—and we have cybersecurity researchers to thank for making sure it wasn’t.

Even as word was still spreading Friday that computers at dozens of hospitals in the U.K. were being maliciously locked down, and a notice demanding ransom posted on their screens, an anonymous researcher known as MalwareTech was in the process of shutting down further spread of the program.

As s/he reported in a fascinating blog post, MalwareTech had found an unregistered URL address in WannaCry’s code. Suspecting that the address had something to do with how the virus communicated—a common feature in botnets and other types of malware—MalwareTech registered the domain and watched as traffic from thousands of infected computers came flooding in, nearly overloading the server hosting the domain. Usually this kind of “sinkhole” move is an effort to disrupt a botnet, for example, from issuing commands to infected systems.

In this case, the domain turned out to be a “kill switch”—on any system that made contact with the URL, the virus shut itself down. WannaCry was on its way out.

As MalwareTech noted, however, malicious programmers could easily alter WannaCry’s code to ping a new address instead. And they did. On Sunday a new variant was infecting thousands of systems in Russia. That, too, was curtailed thanks to the quick work of a cybersecurity researcher.

In the meantime, Microsoft took the unusual step of hustling to distribute a patch for a flaw in the unsupported version of Windows that WannaCry was exploiting. The U.S. National Security Agency had been hoarding the vulnerability, but it was leaked after the theft of the agency’s secrets by a hacking group known as the Shadow Brokers.

Unfortunately, as we’ve stated before, ransomware has become a popular form of cybercrime for one simple reason: it pays. It’s also difficult—though not impossible—to stop. Apart from this weekend’s attacks, criminals have locked down part of San Francisco’s public transit system and a hospital in Los Angeles—in the latter case, forcing the hospital to pony up $17,000 to regain access to its files.

The architects of WannaCry were similarly looking for a quick payday. But they made it pretty easy to follow the money: WannaCry’s code contained the addresses of three Bitcoin wallets. As of midafternoon Monday, a Twitter bot tracking payments to the wallets said the accounts had a total of a little over $55,000 in them.

Thanks to such scrutiny, some experts have speculated that whoever is behind WannaCry won’t dare try to make a withdrawal from the wallets, fearing that it will blow their cover. The sum itself might also give them pause. Sure, it’s a lot of money—but it could’ve been a whole lot more.

(Read more: Malware TechLos Angeles Times, BBC, Quartz, “Holding Data Hostage: The Perfect Internet Crime?,” “Two Ways to Stop Ransomware in Its Tracks”)

Keep Reading

Most Popular

Large language models can do jaw-dropping things. But nobody knows exactly why.

And that's a problem. Figuring it out is one of the biggest scientific puzzles of our time and a crucial step towards controlling more powerful future models.

OpenAI teases an amazing new generative video model called Sora

The firm is sharing Sora with a small group of safety testers but the rest of us will have to wait to learn more.

Google’s Gemini is now in everything. Here’s how you can try it out.

Gmail, Docs, and more will now come with Gemini baked in. But Europeans will have to wait before they can download the app.

This baby with a head camera helped teach an AI how kids learn language

A neural network trained on the experiences of a single young child managed to learn one of the core components of language: how to match words to the objects they represent.

Stay connected

Illustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.