{"id":16518,"date":"2017-05-13T21:05:41","date_gmt":"2017-05-14T01:05:41","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=16518"},"modified":"2021-03-17T10:29:39","modified_gmt":"2021-03-17T14:29:39","slug":"wannacry-ransomware","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/wannacry-ransomware\/16518\/","title":{"rendered":"WannaCry: Are you safe?"},"content":{"rendered":"

(Updated on Tuesday, May 16)<\/em><\/p>\n

A few days ago saw the beginning of the Trojan encryptor WannaCry outbreak. It appears to be pandemic \u2014 a global epidemic. We counted more than 45,000 cases of the attack in just one day, but the true number is much higher.<\/p>\n

What happened?<\/h2>\n

Several large organizations reported an infection simultaneously. Among them were several British hospitals that had to suspend their operations. According to data released by third parties, WannaCry has infected more than 200,000 computers. The sheer number of infections is a big part of the reason it has drawn so much attention.<\/p>\n

The largest number of attacks occurred in Russia, but Ukraine, India, and Taiwan have suffered much damage from WannaCry as well. In just the first day of the attack, we found WannaCry in 74 countries.<\/p>\n

\"\"<\/a><\/p>\n

What is WannaCry?<\/h3>\n

Generally, WannaCry comes in two parts. First, it\u2019s an exploit<\/a> whose purposes are infection and propagation. The second part is an encryptor<\/a> that is downloaded to a\u00a0computer after it has been infected.<\/p>\n

The first part is the main difference between WannaCry and the majority of encryptors. To infect a computer with a common encryptor, a user has to make a mistake, for example by clicking a suspicious link, allowing Word to run a malicious macro, or downloading a suspicious attachment from an e-mail message. A system can be infected with WannaCry without the user doing anything.<\/p>\n

WannaCry: Exploit and propagation<\/h3>\n

The creators of WannaCry have taken advantage of the Windows exploit known as EternalBlue, which relies on\u00a0a vulnerability that Microsoft patched in security update MS17-010<\/a>, dated March 14 of this year. By using the exploit, the malefactors could gain remote access to computers and install the encryptor.<\/p>\n

\n

How to properly update #Windows<\/a> to protect your computer from #WannaCry<\/a> https:\/\/t.co\/QevgKiqEz0<\/a> #ransomware<\/a> pic.twitter.com\/7AKhc2YLFv<\/a><\/p>\n

\u2014 Kaspersky (@kaspersky) May 17, 2017<\/a><\/p><\/blockquote>\n