Large-Scale Ransomware Attack Targets Windows Systems

A widespread ransomware outbreak on Friday has attacked an estimated 45,000 systems in 74 countries, according to a report from the SANS Institute's Internet Storm Center.

The ransomware is identified as "WannaCrypt" and is targeting a Windows Server Message Block (SMB) flaw that was addressed with Microsoft's March MS17-010 "critical" security bulletin release. The Internet Storm Center also identified this flaw as "ETERNALBLUE." Apparently, that's a reference to one of the code names used for a group of hacking tools purportedly collected by the U.S. National Security and then subsequently leaked by a group calling itself "The Shadow Brokers."

The ransomware has hit hospitals in the United Kingdom and Telefonica in Spain, according to the Internet Storm Center. It's affecting National Health Service (NHS) computers in England and Scotland, according a report by The Guardian.

The ransomware, which encrypts a computer's files, is said to present a demand for $300 in Bitcoins to unlock them, along with a threat to double the price.

A Motherboard story suggested that the NHS may have been hit because it continues to run the unsupported Windows XP operating system across thousands of machines. However, MS17-010 is a patch for newer operating systems as well, such as Windows 7 and Windows 8.1, plus Windows Server 2008, Windows Server 2012 and even Windows Server 2016.

The WannaCrypt ransomware exploits a remote code execution flaw in SMB version 2, according to a Kaspersky Lab post. While Microsoft issued MS17-010 to patch the flaw, "it appears that many organizations have not yet installed the patch," Kaspersky Lab indicated. Most of the attacks are happening in Russia, according to the organization. The security firm recommended installing MS17-010, "which closes the affected SMB Server vulnerability used in this attack," among other measures.

When asked about the flaw, Microsoft responded Friday by e-mail, saying that its March update addressed the issue and consumers running Windows Defender and Windows Update would be protected, per a spokesperson:

Today our engineers added detection and protection against new malicious software known as Ransom:Win32.WannaCrypt. In March, we provided a security update which provides additional protections against this potential attack. Those who are running our free antivirus software and have Windows Update enabled, are protected. We are working with customers to provide additional assistance.

Such an outbreak of malware, affecting public institutions, is the kind of scenario found in the novel, "Zero Day." Its author, Mark Russinovich, chief technology officer at Microsoft, acknowledged the similarity on Friday, saying, "Yes, it's a scenario from Zero Day," in a Twitter post.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.


  • 2020 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss. (Now updated with COVID-19-related event changes.)

  • The 2020 Microsoft Product Roadmap

    From the next major update to Windows 10 to the next generations of .NET and PowerShell, here's what's on tap from Microsoft this year.

  • Curvey Stone Steps Graphic

    Microsoft Makes Run at 5G, Edge Computing with Azure Edge Zones

    Microsoft is promising to enable new edge computing scenarios for partners and developers with Azure Edge Zones, which became available as a preview this week.

  • Microsoft's Entire 2020 Event Lineup Going 'Digital-First'

    In response to concerns about the ongoing coronavirus (COVID-19) pandemic, Microsoft is transitioning all of its big conferences in 2020 to be online only.

RCP Update

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.