Ransomware that spread as a worm, beginning on 12 May 2017. It encrypted files and demanded a Bitcoin payment, and unlike most ransomware it propagated by itself using EternalBlue, an exploit against a flaw in Microsoft's SMBv1 file sharing protocol. Any unpatched Windows machine reachable on TCP port 445 could be infected without a user doing anything at all.

An exploit for a remote code execution vulnerability in Microsoft's SMBv1 implementation, addressed by Microsoft in security bulletin MS17-010 on 14 March 2017. The exploit was published by a group calling itself the Shadow Brokers in April 2017, having reportedly originated with the US National Security Agency. WannaCry incorporated it about a month after publication.

Was there a patch available?

Yes, for two months. MS17-010 shipped on 14 March 2017 and the outbreak began on 12 May. Microsoft subsequently took the unusual step of releasing patches for out-of-support versions including Windows XP, which indicates how serious the situation was considered.

What was the kill switch?

Before encrypting, the malware attempted to resolve a specific unregistered domain name. If the lookup succeeded, it stopped. A researcher analysing the sample registered the domain, which caused the check to succeed worldwide and halted that variant's spread. It appears to have been intended as an anti-analysis check, on the assumption that a sandbox environment resolves any domain. Later variants had it removed or altered.

How badly was the NHS affected?

The National Audit Office investigation found 81 NHS trusts in England were affected, and the Department of Health said more than 19,000 patient appointments may have been cancelled. Ambulances were diverted and some services reverted to paper. No patient deaths were attributed to the incident in the NAO's investigation, and the disruption was substantial.

Could it happen again?

The same shape can. A wormable vulnerability in a service exposed across internal networks, exploited before organisations patch, is a recurring pattern rather than a one-off. What has changed is that SMBv1 is now disabled by default on current Windows and internal segmentation is more common. What has not changed is that many organisations still cannot patch an internet-adjacent service inside two months.

WannaCry: A Worm, a Patch Nobody Applied, and a Kill Switch

Most ransomware waits for someone to open an attachment. WannaCry did not wait for anything.

On the morning of 12 May 2017 it began scanning for Windows machines with file sharing exposed and exploiting them directly. An organisation with one vulnerable machine reachable from the internet, or one infected laptop plugged into a flat internal network, could go from a single compromise to hundreds of encrypted machines in an hour. Nobody had to click.

The patch had been available since 14 March.

Timeline

Date	Event
14 March 2017	Microsoft publishes MS17-010, fixing the SMBv1 flaws
April 2017	The Shadow Brokers publish the EternalBlue exploit
12 May 2017, morning	WannaCry begins spreading. NHS trusts, telecoms, manufacturers and logistics operators are affected
12 May 2017, afternoon	A researcher registers the domain the malware checks, halting that variant
13 May 2017	Microsoft issues patches for out-of-support Windows versions
27 October 2017	The UK National Audit Office publishes its investigation into the NHS impact
19 December 2017	The US and UK governments attribute the attack to North Korea

How it spread

Two components, and the combination is what mattered.

The worm. EternalBlue exploits a remote code execution flaw in Microsoft's SMBv1 implementation, reachable on TCP port 445. The malware scanned local subnets and generated random internet addresses, and any unpatched machine that answered was compromised and became a new scanner. Growth was exponential and required no human involvement. SMB Security Explained covers the protocol and its history.

The ransomware. Once on a host, it encrypted files and displayed a demand for a few hundred dollars in Bitcoin.

The payment side was notably poor. There were only a handful of hardcoded Bitcoin addresses and no reliable mechanism to associate a payment with a specific victim, so the operators had no practical way to decide who had paid. Many people who paid received nothing. Whatever the intent behind the operation, it was not a well-built extortion business, which is one of the reasons the attribution discussion pointed away from ordinary criminal motivation.

Why so many machines were unpatched

Two months is a long time for a critical remotely exploitable flaw, and the reasons organisations missed it are the ordinary ones.

Legacy dependencies on an obsolete protocol. SMBv1 dates to the 1980s and was already deprecated. It stayed enabled because something depended on it: an old file server, a multifunction printer scanning to a share, a piece of medical or industrial equipment with firmware nobody could update. Disabling it risked breaking a device that mattered, so it stayed.

Unsupported operating systems. Windows XP and Server 2003 were out of support and still running clinical devices, manufacturing controllers and point of sale terminals. No patch existed for them until Microsoft made an exception the day after the outbreak.

Change control designed for a different pace. Systems with clinical or production uptime requirements patch in windows scheduled weeks ahead. A March patch reaching a June window is normal governance meeting an abnormal risk, which is why Vulnerability Management Lifecycle argues for an emergency path that does not wait for the routine cycle.

Flat networks. The worm needed to reach port 445 on the next machine. In segmented environments it hit boundaries; in flat ones it did not, and most were flat. This is the single change that would most have limited the damage without patching anything, and it is covered in Network Segmentation Guide.

The NHS

The National Audit Office's investigation is the most reliable public account of the impact on a single organisation, and it found 81 NHS trusts in England affected, with the Department of Health stating that more than 19,000 patient appointments may have been cancelled. Some trusts diverted ambulances, cancelled operations and reverted to paper records.

The NAO's findings on preparedness are the durable part. Warnings about the specific vulnerability had been issued in the weeks before. There was a cyber incident response plan that had not been tested locally, so when the incident began there was confusion about who to tell and how. And communications depended on systems that were themselves affected.

That last one recurs in every large incident and is worth taking from this page even if nothing else: your incident response plan must work when the systems it depends on are down. Contact lists on a file share, a plan in a wiki behind single sign-on, and a call tree in an email system are all unavailable in exactly the scenario they exist for. Incident Response 101 covers building the offline version.

The kill switch

Before encrypting, the malware attempted to resolve a specific long, unregistered domain name. If the resolution succeeded, it stopped.

A researcher analysing the sample noticed the check, registered the domain for around ten dollars, and pointed it at a sinkhole. Every new infection worldwide then resolved it successfully and halted.

The likely purpose was anti-analysis. Some sandbox environments answer every DNS query with a synthetic response to keep malware talking, so a lookup for a random domain succeeding is a signal that the malware is being watched rather than running on a real victim. Written into a self-spreading worm, that check became a global off switch.

It was luck, of a kind that does not repeat. Later variants had the check removed, and the underlying vulnerable population did not shrink because of it.

What generalises

Wormable plus unpatched plus flat equals epidemic. Any two of those is survivable. All three is what produced 12 May 2017.
A patch is not a control until it is deployed, and the deployment clock for a remotely exploitable flaw in an exposed service has to be shorter than the routine one.
Legacy protocol debt is security debt. SMBv1 stayed on because turning it off risked breaking something, which is exactly why it was still there when the exploit arrived.
Segmentation limits blast radius when patching fails, and patching does fail.
Your response plan has to survive the incident. Offline copies, out-of-band communications, and a tested call tree.

The verdict

WannaCry required no phishing, no user error and no novel vulnerability. It used a flaw Microsoft had fixed two months earlier, against a protocol that should have been switched off years earlier, across networks with no internal boundaries.

The reason it still gets taught is that the failure was entirely in the ordinary work: inventory, patch cadence, retiring obsolete protocols, and segmentation. None of that was exotic then and none of it is exotic now.