WannaCry ransomware analysis: lateral movement propagation

In just a few hours on May 12, 2017, the WannaCry ransomware worm infected more than 200,000 computers across 150 countries. It reached that scale using a single exploit against a flaw in the SMB protocol used by Microsoft Windows. This blog breaks down the lateral movement technique WannaCry used to spread, how the attack was eventually stopped, its long-term impact, and how deception technology detects ransomware like it at any stage of the kill chain. For a broader look at malware propagation techniques generally, refer to the published paper in Virus Bulletin.

Answer capsule WannaCry is a self-propagating ransomware worm that used the EternalBlue exploit (CVE-2017-0144) against Microsoft’s SMBv1 protocol to spread automatically between machines with no user interaction required. It infected more than 200,000 computers in 150 countries within hours in May 2017. A security researcher halted new infections days later by registering an unregistered domain that acted, by accident, as the malware’s kill switch.

At a glance

• WannaCry is a self-propagating ransomware worm, not a phishing-delivered payload.
• It used EternalBlue (CVE-2017-0144), an NSA-developed SMBv1 exploit leaked by the Shadow Brokers.
• It spread through internal subnet and gateway scanning plus random external IP scanning, both using the same SMB exploitation routine.
• An accidental kill-switch discovery stopped new infections days after the outbreak began.
• Deception technology now detects this class of lateral movement in under 8 milliseconds, regardless of patch status.

In May 2017, the WannaCry ransomware attack made front-page news around the world, with at least 150 countries and over 200,000 customers affected by the attack. The WannaCry ransomware made use of an exploit that targeted the SMB protocol of Microsoft Windows. The attack was able to propagate quickly, in the space of a few hours. The rapid spread of this ransomware attack and the dramatic way in which it was finally stopped have made it an important case study for security teams worldwide.

WannaCry is ransomware based on an exploit targeting the SMB protocol of Microsoft Windows. The exploit was developed by the National Security Agency (NSA) of the United States to compromise Windows servers and desktops running operating systems of that time, such as Windows XP. A threat actor called the Shadow Brokers stole this exploit from the NSA about a month before the ransomware attack was carried out.

Although Microsoft had released a patch for this exploit, the group behind WannaCry was able to attack a multitude of computers on which the patch had not been applied. This lapse gave WannaCry a firm foothold from which it expanded across the globe. The vulnerability in the SMB protocol let the ransomware attack one computer and then pivot to others.

A successful attack on a vulnerable machine encrypted the data files on that computer. The group behind WannaCry asked for bitcoin in return for decryption keys that could release the encrypted files.

WannaCry ransomware analysis showed that the attack used the Microsoft Windows Server Message Block protocol (SMB) to spread within a network. On a vulnerable machine, the malware’s propagation functionality over SMB sits in the “mssecsvc2.0” ServiceHandler function. This function spawns two threads specifically for SMB exploitation: one to infect internal targets and another to infect external targets.

Internal network propagation: subnet and gateway enumeration

In the internal target infection function, the infected host’s network adapters are enumerated. The local DNS servers and gateways are all enumerated by the malware before it attempts to spread to them. The malware checks the IP addresses of local DNS servers to eliminate the possibility that they are public servers. Only the following DNS server ranges are attempted:

• 10.0.0.0 – 10.255.255.255
• 172.16.0.0 – 172.31.255.255
• 192.168.0.0 – 192.168.255.255

External propagation: random IP subnet scanning

In the external spreading function, random IP subnets are enumerated and infection is attempted by the malware. The same SMB spreading function is used in both the internal and external spreading functions: it performs an SMB negotiation, then checks for the presence of an implant indicating whether the target has already been compromised. If the target isn’t already infected, the malware proceeds with the SMBv1 exploit by sending massive Trans2 requests, then performs another SMB negotiation to check whether exploitation succeeded. If exploitation is successful, the malware uses the exploited host to propagate itself via the implant. This pattern, using a single exploit to pivot from host to host with no further user interaction, is documented as a recurring lateral movement technique across ransomware families in a peer-reviewed survey of lateral movement detection methods, not just in WannaCry.

How WannaCry maps to MITRE ATT&CK

Security teams increasingly benchmark ransomware coverage against the MITRE ATT&CK framework, which tracks WannaCry as software S0366. Mapping the attack to specific technique IDs makes it straightforward to test detection tooling against each stage of the kill chain:

See Acalvio’s MITRE ATT&CK use cases for cybersecurity for how security teams operationalize this kind of mapping, and MITRE’s own WannaCry (S0366) entry for the complete technique list.

A few hours after the WannaCry attack started, an independent security researcher studying malware samples from an infected system came upon the kill switch designed by the malware’s creators. The malware would only start encrypting data on a computer if it did not receive a response from a specific domain. A quick check showed that domain was not registered. When the researcher registered it, infected computers received a response and stopped encrypting data from that point onward.

This discovery gave other researchers time to collaborate on threat intelligence and develop decryption keys for files already encrypted by the ransomware. These events paved the way for a slow but steady recovery from the attack.

The SMBv1 vulnerability that enabled the original WannaCry attack has almost been eradicated from networks around the world, but the group behind the attack has not been brought to justice. Security researchers who investigated the campaign found evidence linking it to the Lazarus Group, a group of hackers reportedly patronized by the Government of North Korea. A few other high-profile attacks, including the Sony Corporation hack, have been attributed to the same threat actor. A ransomware variant of the original WannaCry was used in another attack in August 2018.

The underlying exploit class hasn’t gone away either. Internet-wide scans continue to find large numbers of machines still running exposed SMBv1, which is why EternalBlue-style techniques remain part of ransomware playbooks that target legacy, unpatched infrastructure years after the patch shipped.

WannaCry ransomware analysis showed that the attack affected more than 200,000 computers across 150 countries. Some estimates put the financial impact of the attack at close to a few billion US dollars. The attack was stopped just a few hours after it started, by the accidental discovery of a kill switch. Had it had more time to propagate, the global damage would have been significantly higher.

Healthcare services in the United Kingdom suffered a serious setback due to the attack, with computer systems in many hospitals rendered inoperable for a while. Other industries in various parts of the world were affected:

• Telecom companies in Portugal, Saudi Arabia, and Spain
• Petroleum companies in Brazil and China
• Police departments in India and China
• Universities in China and Greece
• Electronics companies in Taiwan and Japan
• State governments in India
• Multinational logistics companies

Some victims may not have come forward to report the attack, so the actual damage caused by WannaCry may be considerably higher than what has been reported.

ShadowPlex detects WannaCry-class ransomware at any stage of the kill chain, including reconnaissance, lateral movement, and encryption, typically in under 8 milliseconds. That speed matters because WannaCry’s automated SMB scanning gives defenders a window measured in seconds, not hours.

Deception doesn’t need to recognize WannaCry’s signature or know whether a given machine has been patched. Decoy hosts, credentials, and network shares placed across on-premises, cloud, and OT segments have no legitimate business use, so any interaction with them is confirmed malicious activity by design. That behavioral independence is what lets deception catch WannaCry-style worms and their unpatched variants without a signature update, and it does so with near-zero false positives.

In the U.S. Navy’s Cyber Resilient Systems ANTX FY25 exercise, ShadowPlex delivered 100% true positives and denied 80% of attacker objectives. Read the full breakdown in Acalvio’s deception technology triumphs at Navy Cyber Challenge. Automated response actions can isolate an infected endpoint the moment a decoy is touched, without waiting on SIEM correlation. Deception adds this layer on top of existing SIEM, EDR, and patch management programs; it doesn’t replace them.

For a deeper look at deception-centric ransomware defense generally, see Deception-centric Defense Against Ransomware. For how deception technology evolved from static honeypots into this kind of automated, AI-assisted coverage, see From Honeypots to AI-Driven Defense.

Ransomware like WannaCry is designed to exploit a specific set of weaknesses in a network. The primary way to prevent ransomware from spreading is to follow security best practices aimed at protecting the network. Keeping all systems up to date with patches goes a long way toward preventing or minimizing the effects of a ransomware infection.

The United States CISA recommends implementing an Active Defense system to protect a network against advanced threats like ransomware. A deception technology solution like Acalvio ShadowPlex is at the core of an Active Defense system, and it complements the network segmentation, endpoint controls, and Active Directory hardening covered in The Role of Deception Technology in the Network Security Reference Architecture, The Role of Deception Technology in the Endpoint Security Reference Architecture, and Microsoft Active Directory Security Part 3: A Deception-Based Approach.