WannaCry: Mass Ransomware Worm Capabilities Campaign - What to do.

This report documents the 2017 WannaCry ransomware campaign that used the leaked NSA EternalBlue exploit (MS17-010) and DoublePulsar backdoor to rapidly spread as a worm across unpatched Windows systems worldwide, disrupting organizations (notably the UK NHS) in over 99 countries; it details kill-switch domains and .onion C2 addresses, targeted file extensions, ransom amounts ($300–$600), and provides mitigation steps including emergency patching, DNS sinkholing, and application whitelisting.