WannaCry? You might.

May 12th, 2017 by Section 8

Urgent information regarding WanaCrypt/WannaCry/WCry Ransom-ware Outbreak

Today, 12 May 2017, a massive ransomware outbreak has been reported across the globe. There are reports of computer systems completely locked up in Russia, Western Europe, East Asia and North America. British hospitals and a Spanish telecom company have been the largest confirmed victims thus far, along with a Spanish financial institution. Critical Start Security Researchers along with additional 3rd party sources have also witnessed activity showing active infections across the remaining continents.


(Source: https://intel.malwaretech.com/botnet/wcrypt/?t=24h&bid=all)

What Can I Do About It?

Immediate Recommendations:

If your enterprise has not installed the latest Windows Update bundles, this needs to be an immediate priority.  Downtimes for upgrades and security patches will cost far less than potential data and productivity losses. Windows XP systems do not have a current patch available**, but some mitigation can be offered by properly configured firewall settings and network segmentation.  For those leveraging Cylance, devices in an auto-quarantine policy have complete protection from file encryption.

For additional information, please feel free to contact your account manager.  Follow our Security Blog at https://www.criticalstart.com/blog/ for additional information on emerging technologies, security recommendations, and news.

Technical Details:

*High Priority*
WanaCryptor 2.0, WannaCry, WCry or WCryp is currently a world-wide ransom-ware outbreak.  These are all versions of Crypto-locker, encrypting victim files and demanding payment via bit-coin.  This vulnerability was patched in the Microsoft March update (MS17-010).

The following links contain information about the exploit that the new malware is using (based on ETERNAL BLUE) and the fix and temporary workaround for servers and local clients, as well as firewall configuration recommendations.

 

**Microsoft did release a patch for Windows XP and Server 2003. See our newer blog posts for additional details.

Field Offices

Connect With us