Echoes of cyberwar
ID: 31c0f415-959d-5332-a3ca-6a6e8284cfc7
STIX ID: report--31c0f415-959d-5332-a3ca-6a6e8284cfc7
Feed Name: Group-IB Blog
WannaCry (WannaCryptor) caused a rapid, global ransomware outbreak by leveraging the leaked NSA EternalBlue SMB exploit and DoublePulsar backdoor to self-replicate across networks, encrypt sensitive documents on infected hosts, and demand ransom; the campaign impacted over 200,000 PCs across 150+ countries and disrupted critical services (hospitals, telecoms, transportation). The report describes technical details (SMB port 445 scanning, targeted file encryption, TOR C2, kill-switch), lists affected groups and mitigation steps (apply MS17-010, patch unsupported OS, backups, consider disabling SMB), and warns the threat can be modified and re-launched.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
