WannaCry: the global ransomware stopped by a $10.69 domain

On May 12, 2017, hospital staff in England encountered a red window on their computers demanding Bitcoin payments. Simultaneously, factories, telecoms, and train stations worldwide displayed the same ransomware message. The malicious software, named WannaCry, spread rapidly, affecting hundreds of thousands of computers across more than 150 countries.

The cause of its swift spread was its worm-like nature, which scanned for other Windows computers and infected them independently. The ransomware exploited an exploit called EternalBlue, which targeted a flaw in the outdated Windows file-sharing protocol, SMBv1. Microsoft had released a patch for this flaw, MS17-010, just two months prior to the WannaCry outbreak.

The majority of infected machines were either not updated or too old to receive the patch. The damage from WannaCry was extensive, with estimates of hundreds of thousands of infections and billions in downtime costs. Marcus Hutchins, a 22-year-old British researcher, discovered the ransomware's kill switch while examining a sample.

He noticed the malware attempted to connect to a nonsensical domain name before encrypting files. Recognizing this opportunity, Hutchins registered the domain for approximately $10.69, effectively halting the spread of WannaCry. The incident highlighted the importance of regular patching, disabling legacy protocols, network segmentation, and maintaining offline backups.

Despite the extensive damage, WannaCry was ultimately contained due to the proactive actions of Marcus Hutchins and the availability of a previously existing patch.