What is WannaCry?

WannaCry, originally named WanaCrypt, also known as Wana Crypt0r and Wana Decrypt0r, is a famous ransomware worm on Microsoft Windows. It uses two NSA-leaked exploits and has wreaked havoc in airports, banks, universities, hospitals and many other facilities. It has spread to some 150 countries worldwide, mainly Russia, Ukraine, the US, and India.

The encryption engine is not vulnerable to brute-force attacks or dictionary attacks as it uses RSA-2048 with random hexadecimal strings; thus, the only way to retrieve files is by backup or directly paying with Bitcoin equivalent to $300 USD (However, the authors forgot to wipe the RSA primes from memory). Required payment increases to the Bitcoin equivalent of $600 USD after 72 hours. 7 days after the victim's infection, the malware starts deleting the encrypted files.

In late June 2018, an email scam called WannaSpam emerged. Hundreds of computer users reported being sent an email from someone (or multiple people), claiming to be the developers of WannaCry. The email threatened to destroy the victims' data unless they sent 0.1 BTC to the Bitcoin address of the "hackers". This was a hoax, as emails cannot directly encrypt files, nor was there any report of anyone who received the email having their files encrypted.

In the report, it found that in August 2019 alone, the security company had detected more than 4.3 million attempts to spread a variant of WannaCry to customer machines.