On May 12th, 2017, a ransomware virus known as “WannaCry” rapidly spread through private networks and the Internet. The ransomware soon held data “hostage” in hundreds of thousands of computer systems, disrupting Great Britain’s National Health Service along with other institutions and businesses across more than 150 countries. However, systems with Webroot SecureAnywhere software installed found themselves thankfully protected from the virus.

Initial wave of attacks

The WannaCry ransomware virus uses a worm-like mechanism, or “cryptoworm,” to spread across private networks and the Internet. Once it affects a system, it encrypts the system’s data and holds it for ransom. The ransomware demands that the system owner’s deposit several hundred U.S. dollars’ worth of Bitcoins into a specific account before the ransomware will release their data.

The WannaCry virus works by exploiting a vulnerability in Windows operating systems. The vulnerability has a complex and storied history and may have been known to the U.S government long before it was known to Microsoft. However, soon after learning of their software’s security vulnerability, Microsoft released a security patch on March 14th, 2017 to protect supported systems.

The initial attack took place on May 12th, 2017 and quickly affected more than 300,000 systems whose owners or administrators had not yet installed Microsoft’s patch. Perhaps the cyber attack’s most prominent target was Great Britain’s National Health System. On May 13th, Microsoft took swift action against the attack. Although it had already released a patch for supported versions of Windows, the company now released an emergency update for legacy versions, including Windows XP and Windows Server 2003, despite the fact that Microsoft no longer officially supported these operating systems.

A security researcher who blogs under the name “MalwareTech” effectively halted the initially wave of attacks. Inadvertently, the researcher found that by registering an extremely long domain name found in the code of the WannaCry malware, the attack came to a halt. In short, registration of that domain was the “kill switch” for the virus.

Further attacks and findings

At least two variants of the initial WannaCry virus began to impact still more computer systems on May 14th, 2017. However, Matthieu Suiche, founder of Comae Technologies, found another kill switch in the code of one of the two variants. According to Suiche in a Tweet with an accompanying graph on May 15th, his company halted roughly “10K machines from spreading further.” As a result, the second wave of attacks was not as effective as the first.

After the initial two waves of attacks, further variants of WannaCry have continued to affect systems across the globe. As of May 25th, 2017, the most recent attack making headlines is WannaCry’s apparent penetration of the postal service in Russia.

Webroot’s protection

One indication of the effectiveness of anti-virus and security software such as Webroot may be customer call volume during an attack. One would expect call volume to spike as users suddenly find their systems compromised. However, according to Webroot’s LeVar Battle, responding to a comment on the company’s May 13th update to the Webroot Threat Blog “our call volume has not been impacted at all by this threat.” The post explains that despite the virus’ widespread impact, the basic structure of the malware itself is “similar to what we’ve seen before.” It is the worm-like propagation of the virus that has taken so many systems by surprise. According to the May 13th blog post, “Webroot SecureAnywhere does currently protect you from WannaCry ransomware.” At the same time, Webroot strongly recommends updating to the very latest version of your system software, a best practice that ensures mult-layered security. Moreover, they recommend becoming as educated as you can about ransomware and other common security threats.

Webroot’s latest post, addressing the second wave of attacks, reinforces their earlier reassuring statement and further maintains that Webroot is continuing to develop new solutions to protect their users against WannaCry variants as they arise.Â

Staying secure

The WannaCry ransomware attack is one of the most damaging cyber-attacks in years. The virus’ worm-like method of propagation exploits a vulnerability in Microsoft operating systems. Although Microsoft released a patch for supported systems well ahead of the attack, many companies and institutions did not install the patch in time. As a result, WannaCry’s initial wave of attacks affected more than 300,000 computer systems across more than 150 countries. Although cybersecurity researcher MalwareTech inadvertently halted the inital attack with a kill switch, new variants have continued to arise. Thankfully, users of leading security software Webroot SecureAnywhere found themselves protected from the attack.

Contact us to learn more about how Webroot can help protect you from malicious security threats such as WannaCry.