WannaCry Ransomware Attack
A Global Cybersecurity Incident (2017)
Introduction
In May 2017, a dangerous ransomware attack called WannaCry appeared.
It was not just a normal virus – it was a worm that spread automatically.
WannaCry took advantage of a Windows security weakness
(EternalBlue).
Within just days, it infected over 200,000 computers in more than 150
countries.
How the Attack Happened
Hackers used the EternalBlue exploit, which had been leaked
by a group called the Shadow Brokers.
Once it entered a vulnerable computer, WannaCry encrypted (locked) all
personal files.
Victims saw a message demanding Bitcoin payments to get their files
back.
Unlike many other attacks, WannaCry spread without any clicks or
downloads – it jumped across networks on its own.
How It Was Stopped
A young security researcher, Marcus Hutchins, discovered that
the ransomware had a hidden “kill switch”.
Marcus Hutchins
He noticed the malware was trying to connect to a strange, unused
domain name.
When he registered that domain, WannaCry suddenly stopped spreading
further.
This showed the power of quick action, network monitoring, and reverse
engineering in cybersecurity.
What To Do If Infected
Disconnect the computer from the internet immediately to stop the
spread.
Do not pay the ransom – there is no guarantee files will be restored.
Try to recover data from backups if available.
Some tools, like WannaKey, were able to unlock files in certain versions.
Always report the incident to your IT team or authorities for investigation.
Prevention Measures
Always update Windows and apply security patches on time.
Disable old protocols such as SMBv1 if they are not required.
Use antivirus software, firewalls, and intrusion detection systems.
Make regular backups of important files, stored safely offline.
Provide cybersecurity awareness training so users can recognize
risks.
Conclusion
The WannaCry attack proved how fast and damaging ransomware can be
on a global scale.
It highlighted the critical importance of keeping systems patched and
updated.
The quick response from researchers and security companies played a
huge role in stopping it.
The main lesson: Cybersecurity is a shared responsibility, and prevention
is always better than cure.
Presented to you by:Mohamed Abdelazim
Mohamed Nael
Supervised by:
IEEE ZSB
Eng Shahd