On May 12, 2017, WannaCry spread rapidly across organizations in many countries. It combined ransomware with worm-like propagation exploiting a vulnerability in Microsoft’s SMB implementation addressed by security bulletin MS17-010. The event exposed how unsupported systems, incomplete asset knowledge, patching constraints, flat networks, and fragile recovery can combine into systemic disruption.

What happened

WannaCry encrypted files and demanded cryptocurrency payments while attempting to spread to other reachable Windows systems. Attribution and victim counts should be stated only with dated authoritative evidence; estimates vary by telemetry and definition.

Microsoft had released supported-system patches in March 2017. After the outbreak, it also issued updates for some older unsupported platforms. The existence of a patch did not mean every organization could identify, test, deploy, verify, or recover affected systems safely.

The kill switch reduced spread, not risk

A researcher registered a domain queried by samples, which disrupted propagation for relevant variants. It did not decrypt affected files, eradicate infections, patch vulnerable hosts, or stop every later variant. Organizations still needed containment, investigation, restoration, and remediation.

Why disruption became widespread

  • Incomplete inventories and unsupported operating systems.
  • Exposed or reachable SMB services and insufficient segmentation.
  • Patch testing and maintenance constraints in critical environments.
  • Weak detection, isolation, incident coordination, and recovery readiness.
  • Dependencies on endpoints whose unavailability disrupted essential workflows.

Defensive lessons

  1. Maintain an asset/version inventory with ownership and criticality.
  2. Prioritize exploited vulnerabilities, test updates, stage deployment, verify success, and retain rollback.
  3. Disable obsolete protocols where feasible and restrict administrative and lateral-movement paths.
  4. Segment networks around mission and failure domains, not organizational charts alone.
  5. Use endpoint protection and monitoring as layers, not guarantees; see endpoint management.
  6. Protect backups from production trust paths and test restoration against recovery objectives.
  7. Exercise incident authority, communications, legal/privacy involvement, containment, evidence handling, and recovery.

Respond to suspected ransomware

Follow the organization’s incident plan and current government guidance. Isolate affected systems using approved methods, preserve evidence, determine scope, protect backups, revoke compromised credentials, and coordinate reporting. Do not destroy evidence or reconnect systems before validation. Payment does not guarantee recovery and can create legal and sanctions concerns; involve qualified authorities and counsel.

WannaCry is not NotPetya

Both outbreaks used SMB-related propagation in 2017, but their mechanisms, objectives, and recovery characteristics differed. Do not merge their timelines or describe all destructive malware as ransomware. See the separate NotPetya analysis.

Apply the broader layered practices in network security. The durable lesson is not that one patch or kill switch would prevent every crisis; resilient systems combine inventory, secure design, patching, segmentation, detection, rehearsed response, and tested recovery.

Originally published December 24, 2017; technically reviewed and substantially updated September 4, 2026.