What was the WannaCry ransomware attack and what should we learn?

WannaCry was a ransomware campaign that spread rapidly from 12 May 2017 by exploiting a critical Windows SMB vulnerability, MS17-010. Microsoft had released a patch on 14 March 2017. The incident is remembered less for clever malware than for how much damage an unpatched, reachable service can cause.

What did CISA report at the time?

The US government's alert, issued by DHS and the FBI and since archived, said a widespread ransomware campaign was affecting organizations, with reports of tens of thousands of infections in over 150 countries. The software could run in as many as 27 languages. The alert said the latest version, known as WannaCry, WCry or Wanna Decryptor, was discovered the morning of 12 May 2017 by an independent security researcher and spread over several hours, with initial reports around 4:00 AM EDT.

The reported ransom demand was 0.1781 bitcoins, roughly 300 US dollars at the time. The alert was later updated to record the US Government's public attribution of the WannaCry variant to the North Korean government. CISA marks the page as archived content that may not reflect current programs, so read it as a historical record.

How did it get in?

Initial reports indicated the actor gained access to enterprise servers by exploiting a critical Windows SMB vulnerability. Microsoft had issued a security update for MS17-010 on 14 March 2017. On 13 May 2017 it also released patches for older systems it no longer routinely supported, including Windows XP, Windows 8 and Windows Server 2003.

That timeline is the heart of the story. A fix existed for about two months before the outbreak for supported systems. The organizations hit hardest were those that had not applied it, ran systems past their support window, or exposed SMB where it should not have been reachable.

Why does it still matter?

WannaCry combined three conditions that still exist:

1. A known vulnerability with an available fix. Patching is routine in theory and slow in practice, especially on operational systems where downtime is costly.
2. Unsupported or unmanaged systems. Old devices run for years because replacing them is hard. Each one is a standing exposure.
3. A flat network. Once the code ran inside, it could reach other machines that shared the same weakness.

The scale came from automation. Nobody was clicking links one by one.

A constructed lesson

Picture a plant with 60 Windows machines. Fifty are patched through management software. Ten run a machine control application that vendor guidance said not to update. Those ten sit on the same network as the office. An attacker who gets code onto any office PC reaches the ten. A simple outcome of segmentation would have been that the ten were reachable only from one jump host, so the flaw mattered much less.

How to check or apply this

1. Know what you run. Keep an inventory with operating system and patch level, including operational technology you do not manage centrally.
2. Set a deadline for critical patches and track compliance against it. Measure days from release to fixed, not just a yes or no.
3. Do not expose file sharing services such as SMB to the internet, and restrict them internally to the hosts that need them.
4. Segment the network so systems that cannot be patched sit behind tight rules.
5. Keep offline, tested backups. Practice a restore, since the ransom is a decision you can avoid only if recovery works.
6. Plan replacement for systems that have left vendor support, with a dated target.
7. Read CISA's current guidance on ransomware for newer practices, since attackers have changed.

What does the timeline teach about patching?

Two months between the fix and the outbreak sounds long, but many organizations measure patching in quarters. Some cannot patch quickly: a hospital device with a vendor warranty, a production line, a lab instrument. For those, the question is not "why didn't you patch?" but "what protects the system until you can?" Network rules, removal from the internet, and a dated replacement plan are all answers. Having no answer is the gap.

It also shows why a public alert matters. CISA's note carried indicators of compromise in spreadsheet and STIX form so defenders could search for them, which is a model for how to share findings during an incident.

Quick check

Sources

• CISA alert: Indicators Associated With WannaCry Ransomware, archived, fetched 18 October 2026.

Last reviewed: 18 October 2026.