WannaCry? You might.

May 12th, 2017 by Section 8

Urgent information regarding WanaCrypt/WannaCry/WCry Ransom-ware Outbreak

Today, 12 May 2017, a massive ransomware outbreak has been reported across the globe. There are reports of computer systems completely locked up in Russia, Western Europe, East Asia and North America. British hospitals and a Spanish telecom company have been the largest confirmed victims thus far, along with a Spanish financial institution. Critical Start Security Researchers along with additional 3rd party sources have also witnessed activity showing active infections across the remaining continents.


(Source: https://intel.malwaretech.com/botnet/wcrypt/?t=24h&bid=all)

What Can I Do About It?

Immediate Recommendations:

If your enterprise has not installed the latest Windows Update bundles, this needs to be an immediate priority.  Downtimes for upgrades and security patches will cost far less than potential data and productivity losses. Windows XP systems do not have a current patch available**, but some mitigation can be offered by properly configured firewall settings and network segmentation.  For those leveraging Cylance, devices in an auto-quarantine policy have complete protection from file encryption.

For additional information, please feel free to contact your account manager.  Follow our Security Blog at http://criticalstart.wpengine.com/blog/ for additional information on emerging technologies, security recommendations, and news.

Technical Details:

*High Priority*
WanaCryptor 2.0, WannaCry, WCry or WCryp is currently a world-wide ransom-ware outbreak.  These are all versions of Crypto-locker, encrypting victim files and demanding payment via bit-coin.  This vulnerability was patched in the Microsoft March update (MS17-010).

The following links contain information about the exploit that the new malware is using (based on ETERNAL BLUE) and the fix and temporary workaround for servers and local clients, as well as firewall configuration recommendations.

 

**Microsoft did release a patch for Windows XP and Server 2003. See our newer blog posts for additional details.


Critical Start is the fastest-growing cybersecurity integrator in North America. Our mission is simple: protect our customers’ brands and reduce their business risk. We do this for organizations of all sizes through our award-winning portfolio of end-to-end security services – from security-readiness assessments using our proven framework (the Defendable Network) to the delivery of managed detection and response, incident response, professional services, and product fulfillment. Critical Start has been named to the CRN 2018 Tech Elite 250 and top 100 Security MSPs lists.