On May 12, 2017, WannaCry ransomware began spreading across networks worldwide. Within days, it infected an estimated 200,000 computers across 150 countries. Hospitals postponed surgeries. Factories halted production. The attack demonstrated how quickly vulnerabilities can be weaponized and how unprepared many organizations remain.
This isn’t just a story about one malware outbreak. It’s a case study in why security fundamentals matter and what happens when organizations neglect them.
What Happened
WannaCry exploited a vulnerability in Windows SMB (Server Message Block) protocol, codenamed EternalBlue. The vulnerability allowed remote code execution—an attacker could run arbitrary code on vulnerable systems without authentication.
The Timeline
March 14, 2017: Microsoft releases security bulletin MS17-010, patching the SMB vulnerability. The patch is available for all supported Windows versions.
April 14, 2017: Shadow Brokers (a hacker group) publicly releases EternalBlue exploit, allegedly stolen from the NSA. The exploit is now available to anyone.
May 12, 2017: WannaCry appears in the wild, using EternalBlue to spread automatically across networks.
Within 24 hours: Hundreds of thousands of infections across healthcare, manufacturing, telecommunications, and government sectors.
How It Spread
WannaCry was a worm—it spread automatically without user interaction:
- Scans network for systems with port 445 (SMB) open
- Attempts EternalBlue exploit
- If successful, installs ransomware and continues scanning
- Encrypts files, demands Bitcoin ransom
The self-propagating nature meant one infected machine could rapidly infect an entire network.
The Kill Switch
A security researcher (MalwareTech) discovered WannaCry checked a specific domain before encrypting files. If the domain responded, WannaCry stopped. By registering this domain, MalwareTech accidentally triggered a kill switch that slowed the spread.
This was luck. The kill switch wasn’t a deliberate feature—likely an anti-analysis technique. Without it, damage would have been far worse.
Why It Worked
WannaCry exploited organizational failures, not just technical vulnerabilities.
Unpatched Systems
The patch was available for two months before WannaCry appeared. Organizations with functioning patch management were protected. Those without were vulnerable.
Why systems remained unpatched:
- Legacy systems: Older applications incompatible with updates
- Operational concerns: Fear that patches break things
- Resource constraints: Not enough staff to manage patching
- Lack of visibility: Didn’t know what systems existed
- Negligence: Patching wasn’t prioritized
Flat Networks
Many organizations ran flat networks—all systems could communicate with all other systems. WannaCry exploited this to spread from initial infection to every vulnerable system on the network.
Network segmentation would have limited spread. An infected workstation in accounting shouldn’t be able to reach systems in manufacturing.
Exposed SMB
SMB (port 445) should rarely be exposed to the internet. Yet many organizations had internet-exposed SMB services—either intentionally or through misconfiguration.
These directly-exposed systems provided initial entry points.
Legacy Windows
WannaCry disproportionately affected Windows XP and Windows Server 2003—operating systems no longer receiving security updates. Organizations running these unsupported systems had no patches available.
Microsoft took the unusual step of releasing emergency patches for these unsupported systems, acknowledging the severity.
Lessons Learned
Patch Management Is Not Optional
The patch existed. Organizations that applied it were safe. It’s that simple.
Implement patch management:
- Inventory all systems (you can’t patch what you don’t know about)
- Categorize by criticality
- Test patches in staging environments
- Apply critical patches within days, not months
- Automate where possible
For systems you can’t patch:
- Network isolate them
- Implement compensating controls
- Plan for replacement
Network Segmentation Limits Blast Radius
Flat networks enable malware to spread everywhere. Segmented networks contain infections.
Implement segmentation:
- Separate networks by function and sensitivity
- Control traffic between segments
- Use VLANs, firewalls, and access controls
- Apply zero-trust principles—verify before allowing communication
Eliminate Unnecessary Exposure
Every exposed service is attack surface. Minimize it.
- Audit what’s exposed to the internet
- Close unnecessary ports
- Require VPN for internal service access
- Regular scanning to detect exposure
SMB exposed to the internet is almost never necessary. The same applies to many internal services.
Support Lifecycle Matters
Running unsupported operating systems means no security updates. This isn’t theoretical risk—WannaCry proved it.
- Maintain lifecycle awareness for all software
- Plan migrations before end-of-support
- If you must run unsupported systems, isolate them completely
- Budget for ongoing modernization
Backup and Recovery
Ransomware’s threat depends on backup availability. If you can restore from backups, ransomware becomes an inconvenience rather than a catastrophe.
Backup best practices:
- Regular, automated backups
- Test restoration (backups you can’t restore from aren’t backups)
- Offline or air-gapped backups (malware can encrypt network-connected backups)
- Backup versioning (ability to restore from before infection)
Incident Response Readiness
WannaCry spread fast. Organizations needed to respond immediately—identify exposure, isolate systems, apply patches, restore from backups.
Organizations with incident response plans and practiced procedures responded effectively. Those without scrambled.
- Have an incident response plan
- Practice through tabletop exercises
- Maintain contact lists and communication channels
- Know how to isolate systems quickly
Implementing Defenses
Immediate Actions
- Patch MS17-010 on all Windows systems
- Disable SMBv1 where not required
- Block port 445 at network perimeter
- Segment networks to limit lateral movement
- Verify backup integrity and restoration capability
Ongoing Practices
- Continuous patching: Establish and maintain patch management processes
- Vulnerability scanning: Regular scanning to identify gaps
- Network monitoring: Detect anomalous lateral movement
- Security awareness: Train users on recognizing phishing (common initial vector)
- Incident response: Plan, practice, and improve
Technical Controls
- Endpoint protection: Modern antimalware with behavioral detection
- Network detection: Monitor for exploit patterns
- Application whitelisting: Only allow approved executables
- Privilege management: Limit admin rights to reduce malware capability
The Bigger Picture
WannaCry wasn’t sophisticated. It exploited a known vulnerability with an available patch. Organizations that followed basic security hygiene were protected.
This is the uncomfortable truth: most breaches exploit known vulnerabilities, missing patches, and basic security failures. Advanced attackers exist, but most damage comes from failure to implement fundamentals.
WannaCry’s lessons aren’t new. They’re the same lessons security professionals have repeated for years:
- Patch your systems
- Segment your networks
- Minimize attack surface
- Maintain backups
- Prepare for incidents
The organizations that suffered most were those that hadn’t implemented these fundamentals. The organizations that escaped were those that had.
Key Takeaways
- WannaCry exploited a vulnerability patched two months before the attack
- Self-propagating malware spreads through flat networks rapidly
- Patch management, network segmentation, and backup are foundational defenses
- Legacy, unsupported systems create critical vulnerability
- Incident response readiness determines recovery speed
- Most damage comes from failure to implement known security fundamentals