WannaCry, the Ransomware Attack that Changed the History of Cybersecurity

Key Takeaways

• WannaCry infected >200,000 systems across 150+ countries in hours.
• Exploit used EternalBlue, an NSA tool leaked by Shadow Brokers.
• Patch MS17-010 released months earlier; many organizations remained unpatched.
• Kill switch domain registration by Marcus Hutchins slowed global spread.
• Attack underscored importance of patch management, segmentation, and cooperation.

Pulse Analysis

WannaCry’s rapid spread was rooted in a single technical flaw: the SMBv1 vulnerability (CVE‑2017‑0144) that Microsoft patched in MS17‑010 months before the attack. The exploit, dubbed EternalBlue, originated from the U.S. National Security Agency’s cyber‑offensive arsenal and was exposed by the Shadow Brokers hacker collective in early 2017. By weaponizing this tool, the ransomware transformed into a self‑propagating worm, capable of scanning and infecting any vulnerable Windows machine without user interaction. This convergence of a high‑grade exploit and lax patching created a perfect storm for a global cyber incident.

When WannaCry hit on May 12, 2017, it compromised more than 200,000 endpoints across 150 nations, paralyzing British hospitals, Spanish telecom operators and countless corporate networks. The ransom demand, initially around $300 in Bitcoin, was secondary to the operational disruption caused by encrypted files and network downtime. The emergency response was accelerated when researcher Marcus Hutchins registered a dormant domain that acted as a kill switch, curbing further propagation. The episode exposed a systemic failure to apply critical updates and underscored the need for robust network segmentation and rapid incident‑response coordination.

In the years following the attack, organizations have elevated patch management to a strategic priority, integrating automated update pipelines and continuous vulnerability scanning into their security operations. Governments and industry groups have also forged information‑sharing frameworks to detect and contain large‑scale threats more efficiently. Moreover, the controversy over the NSA’s stockpiled exploits sparked policy debates about responsible disclosure and the risks of cyber‑weapon hoarding. As ransomware continues to evolve, the WannaCry legacy serves as a reminder that even publicly known flaws can be weaponized with devastating effect if left unaddressed.