WannaCry? You Might. | Critical Start
Our new MOBILESOC UI makes alert resolution and collaboration on the go more efficient and intuitive.
Learn real world attack and defense strategies with Adversarial Emulation and Active Defense training from TEAMARES
TEAMARES launches Breach Attack as a Service for quick testing whenever your environment changes.
Webinar Series | Once More unto the Breach | Lessons Learned from Billion Dollar Breaches

WannaCry? You Might.

Urgent Information Regarding WanaCrypt/WannaCry/WCry Ransom-ware Outbreak

Today, 12 May 2017, a massive ransomware outbreak has been reported across the globe. There are reports of computer systems completely locked up in Russia, Western Europe, East Asia, and North America. British hospitals and a Spanish telecom company have been the largest confirmed victims thus far, along with a Spanish financial institution. Critical Start Security Researchers along with additional 3rd party sources have also witnessed activity showing active infections across the remaining continents.


What Can I Do About It?

Immediate Recommendations:

If your enterprise has not installed the latest Windows Update bundles, this needs to be an immediate priority.  Downtimes for upgrades and security patches will cost far less than potential data and productivity losses. Windows XP systems do not have a current patch available**, but some mitigation can be offered by properly configured firewall settings and network segmentation.  For those leveraging Cylance, devices in an auto-quarantine policy have complete protection from file encryption.

For additional information, please feel free to contact your account manager.  Follow our Security Blog for additional information on emerging technologies, security recommendations, and news.


Technical Details:

High Priority
WanaCryptor 2.0, WannaCry, WCry or WCryp is currently a world-wide ransom-ware outbreak.  These are all versions of Crypto-locker, encrypting victim files and demanding payment via bit-coin.  This vulnerability was patched in the Microsoft March update (MS17-010).

The following links contain information about the exploit that the new malware is using (based on ETERNAL BLUE) and the fix and temporary workaround for servers and local clients, as well as firewall configuration recommendations.

  • Firewall Configuration
    • Ensure that port 445 is blocked for firewall communications with all exceptions scrutinized and verified before adding.


Note: Microsoft did release a patch for Windows XP and Server 2003. See our newer blog posts for additional details.

Contact an MDR Specialist Today

Get in Touch
Path 11 Copy 2 Created with Sketch.
Path 11 Copy 3 Created with Sketch.

Related Content