Neo Hang
November 28, 2025
CSI 2460
WannaCry Attack Phase II
The WannaCry Attack was a global ransomware + worm attack that infected up to 300,000
systems at multiple key industrial areas. Hospitals were unable to access any files, certain
software applications were now unavailable for auto-industries, and more interruptions to supply
chains and logistics. The ransomware hadn’t directly deleted any files, however it did lock them
behind a paywall asking for a bitcoin transaction that would allow them to decrypt it once paid.
That, however, was not a guarantee in itself, as some people didn’t know what bitcoin was at
the time (an untraceable currency) and were not even sure if it would actually go through. This
attack then propagated these very exploits to other systems through its Worm-like nature,
scanning vulnerable systems with an unpatched EternalBlue version and infecting them with
ransomware. It wasn’t until Marcus Hutchins (also known and MalwareTech), a cybersecurity
researcher who analyzed malware, was able to find a kill switch in WannaCry’s domain name.
The attack lasted for 24 hours, and while Marcus was able to stop its spread, some systems still
remained under encryption until later.
The threat actors behind this massive attack was initiated by a group called the Lazarus Group,
a North Korean based hacker team that operated on financial heists, disrupting companies, and
other operations that preyed upon any assets that benefitted them financially. How they initiated
this massive operation can be sampled into a cyber-kill chain that photos their plans into several
steps.
The first step was Reconnaissance. The Lazarus Group had gotten their hands on an exploit
with the help of an actual other group called the Shadow Brokers, which were hacktivists that
leaked government tools from the NSA as an act against Donald Trump and his policies. These
government tools were then bought off by the Lazarus Group, one of these tools being the
EternalBlue exploit, a government made cyber-weapon specifically made to execute certain
codes from a remote place, targeting Microsoft’s old SMBv1’s server protocols. Because this
exploit specifically worked on systems that were not yet updated or had versions that did not
disable EternalBlue’s mechanics on them, reconnaissance was minimal as the Lazarus Group
only had to pick one vulnerable system that would inevitably propagate to other vulnerable
systems across the network by scanning ports and attacking unupdated versions.
Weaponization had begun long before reconnaissance was actually enacted. As described
before, the NSA’s own leaked exploits made it easy for the Lazarus Group to conduct their
attack on any vulnerable system. However, EternalBlue was not the sole tool in the operation.
Another acquired tool that the Lazarus Group used was called DoublePulsar, which allowed for
the ransomware to be implemented in the first place. EternalBlue was the window which let the
attackers inside any system with SMBv1 still enabled, then DoublePulsar being the actual tool
that loaded the malware into the compromised system.
This would lead on to Delivery, a step mostly fulfilled by EternalBlue. Unlike other attack
vectors that malware was able to pass through, there was little to no need for any input from an
unsuspecting user or any social engineering. Instead, the Lazarus Group relied on EternalBlue
to exploit vulnerable systems still on SMBv1 protocols. To understand exactly how, one must
know what SMBv1, or rather, what SMB is. SMB, or Server Message Block, is the transport
protocol used by Windows that deals with file sharing, printer sharing, and other applications
with Windows. SMB uses TCP ports 139 and 445, among these ports it enables SMB
transactions to occur (Thomas, 2017). With EternalBlue, it’s able to bypass many protocol
functions through buffer overflow, allowing the leftover request data, which could be the malware
itself and DoublePulsar, to be inserted into the system’s kernel.
As soon as EternalBlue finds a system with only SMBv1, Exploitation occurs right away. Once
buffer overflow is triggered, memory corruption occurs and a remote code is executed in the
kernel. Because the kernel is the core on which the entire OS (Operating System) is built on,
attackers gain system privileges. After the exploitation, DoublePulsar is then used by the
attackers as a backdoor for persistent and repeated code control.
DoublePulsar is what makes the purpose of Installation the point of no return in this particular
scenario. With EternalBlue allowing the tool to be installed on the kernel, the attackers have a
limitless access to the computer now that DoublePulsar allows their persistent exploitation of the
entire Operating System and its core settings. First, it executes raw shell code in the kernel
memory itself, which gives way to a DLL injection that functions as the platform on which the
Wannacry Ransomware will show up on the computer. After the installation, DoublePulsar’s
backdoor remains invisible and cannot be detected while its running the ransomware directly
from the kernel, so any attempt to shut down the system or reboot it will not force it off.
With the installation of DoublePulsar in the kernel, Command and Control (C2) would not stop
unless it was internally halted. The hardcoded domain of the Wannacry attack that allowed for
its propagation worked like a loop. The domain was coded to not work and if it did not, it would
still search for more ports and vulnerable systems, propagating itself across networks like a
worm. This worm spread more and more with DoublePulsar by responding to SMB packets that
alerted the worm that the system was already being controlled by their attacker and would have
to go and search for another system. Among all these, control was maintained through the
ransomware locking and encrypting files behind a paywall. After that, most of the end goals of
the Lazarus Group were being achieved so long as the worm was propagating itself across
SMBv1 systems and encrypting files in exchange for a bitcoin currency, fulfilling the Actions on
Objectives part of the Kill Chain.
While the main targets of this attack was the encryption of files that disabled several logistical
operations that could have lead to catastrophic situations, there was only one part of the CIA
triad that was mostly affected among the three. That was, Availability. Confidentiality may at
first seem to be the compromised pillar in the Triad, however, there’s never any confirmed
evidence that the Lazarus group had direct access to each and every file. Integrity had been
somewhat manipulated via encryption, changing access to data without authorization. One
could argue that confidentiality was breached when the Shadow Broker leaked the NSA built
cyber-tools to the public, but within the context of the Kill-Chain, the Lazarus Group seemed to
have only disrupted the availability of the systems. Availability was mostly affected when these
files were encrypted and this encryption spread through other systems. This collapse of
availability was nearly catastrophic as it affected daily life needs. Hospitals were unable to
access hospital records, surgeries were canceled and appointments delayed. In Germany,
certain rail systems were under a ransomware which affected transportation for people.
Manufacturing lines for certain automobile industries were halted and many more logistical
issues arose across the globe. Availability suffered at an almost monstrous scale that may have
been destructive to thousands of supply chains had the worm not been stopped.
Because the attack’s nature seemed to prey on vulnerable systems the most, the glaring
security control in the attack was the negligence in updating the systems. This technical issue
led to the propagation of this ransomware to reach global heights and was somewhat
unavoidable with human imperfection. The lack of application of security patches allowed for the
WannaCry worm to detect networks still on SMBv1 protocols. MS17-010, the patch update for
windows that was released after the advent of the EternalBlue leak, was supposed to inhibit the
tool from working on any SMB protocol. However, systems that were neglected, ignored
automatic updates, or were simply not looked at, allowed for EternalBlue to still work on
unsuspected systems. Automated updated enabled or scanners that alerted the user of the
need for updates might have prevented any further exploitation. Had system patch updates
been regularly implemented, the ransomware may have only infected a handful of systems.
​
Another security control issue that led to WannaCry being of this scale were Firewall issues,
more specifically, a lack of segmentation that ultimately led to entire networks being infected.
This meant that one machine infected could have led to the entire building’s system being
locked up because of WannaCry’s ability to scan certain ports, such as port 445 which most
machines were on. Segmentation of these Firewall networks may have led to less machines
infected, allowing infrastructure to have a backup plan in case a system was locked up.
Both of these issues stemmed from a lack of technical security measures. Little to no
segmentation of the network led to compromised networks, while negligence in software and
patch updates are what allowed EternalBlue to enable the Lazarus Group to upload their
malware and instructions into the kernel. There may have been some reprieve if there were
some administrative security measures, however when the kernel itself (the inner ring of the
entire system) is compromised, then it would be hard for even admins to prevent the exploitation
from working.
Because this attack was on an unprecedented scale, every business affected was caught in the
same boat. However, for smaller businesses, preventive measures against the WannaCry attack
may not have been sufficient enough and probably was an inevitable consequence. Larger
businesses had their files encrypted just like smaller businesses, however for smaller
businesses, the usual care around networks and cybersecurity is almost neglected. Few
systems to work with, less segmentation or even no segmentation at all, and limited IT or
consultant staff members on board to oversee the operations. However, there are some
advantages in their response to the WannaCry attack. There’s faster momentum in decision
making, fewer devices to look over and are often updated with newer systems which larger
companies may have difficulty looking over. Larger companies might have to deal with top-down
decision making that might just lead to more complex issues not only with the network but now
hierarchy in the workplace, communication issues, and a bad rep with clientele should they
have trouble even notifying their users of the current situation at hand. A simple and small
infrastructure may also lead to less worm propagation around the network as well. But these
advantages also show how fragile a company may be should there not be any sense of security
implemented with the utmost priority. That is, a simple misstep could lead to the entire business
being disrupted. There are less resources available for the small business to turn to,
understaffed faculty could lead to negligence in updating software and such an attack could lead
to a total shutdown of the business itself if it cannot afford the logistical disruptions it faced.
Larger businesses on the other hand, carry an equal amount of advantages and disadvantages
they must deal with. Larger businesses sport a wide variety of resources to turn to such as good
patching software. With a wider network and a committed cybersecurity team, an overseeing
eye that makes sure each system is up to date may mitigate more situations like WannaCry
from occurring. There’s also more chance of recovery that a larger business can pull from rather
than smaller businesses that may suffer heavy losses in network infrastructure. Larger
businesses can have teams reload entire operating systems or replace them entirely. However,
like said before, a larger infrastructure could be too many control points to take care of and with
the nature of WannaCry, one overlooked system may be the patient zero that could spread
throughout the entire network if neglected.
Before the WannaCry attack, patch management was seen as a boring and tedious job to look
over when it came to cybersecurity communities. However, with the advent of Wannacry, it
instantly became a high-level topic among Cybersecurity hubs and a vital rule to the secure
keeping of systems (Houlding, 2017). Because the attack was nearly a global phenomenon,
Ransomware went from an old IT problem to an actual infrastructural risk that may have worse
versions to come should a hack like this happen again to key manufacturing areas, hospitals,
and more resourceful entities. WannaCry also shed light on the NSA and their handling of
exploitative tools that were leaked. This lead to a long debate about intelligence agencies
handling 0-day policies when it came to transparency about these tools, which ultimately led to
EU’s Cyber Resilience Act that cited WannaCry as an example of damage from suboptimal
product security.
The legal ramifications included the UK’s National Audit Office (NAO) investigating these
affected businesses. They found and published reports of poorly cared for systems that may
have prevented this had they been up to date. Unsupported OS’, unpatched systems, and lack
of rehearsed Cyber incident layouts (NAO, 2017). The failure to uphold basic security principles
led to severe fines for organizations. While the GDPR was still being audited to be in service,
there were still legal ramifications that became a huge blow to companies when ransomware
was being treated no more as a simple IT issue but an actual data breach that showed how
negligent the company may be. The WannaCry attack occurred before anything cyber-related
was legally enacted but became a major part in the GDPR as an example used by lawyers to
show why stronger fines and obligations might have to be necessary in order to ensure a
properly working system (Clarke, 2017). A similar incident with a comparable attack vector was
the NotPetya attack, which happened not long after the WannaCry situation (Microsoft, 2017).
That blocked out users from being able to access banking records and affect tax-paying
transactions between the government and citizens. That also spread via a compromised system
that disrupted infrastructure and had to do with the software update. However, instead of
neglected patches being the reason why the malware went through, it was the other way around
with the new patch carrying the attack itself.
AI Usage
1.​ AI usage helped a lot in pinpointing down the accuracy of the events ordered. It was able
to broadly pick out the timeline in which the attack was conducted, but also go into detail
into each step, especially when I prompted for it to make each step branch off into
smaller steps that made it more clear as to what exactly happened. Like the EternalBlue
exploit and how the Lazarus Group used DoublePulsar to actually upload the malware
instead. It also provided sources and citations so information was corroborated or made
up by the AI itself.
2.​ AI benefit me a lot mostly by saving time. Researching articles that helped with my
current topic were usually far and few but with how ChatGPT handles prompt, its able to
recognize what I’m getting at and find articles relating to my questions and topics. Like
before, it also formats the subject I’m getting at into very simple and compact ways that I
find easier to read and interpret.
3.​ While AI is great at formatting notes and also letting you interpret these things better, it
also falls into the trap of being too helpful, that is, never letting you know if what you’re
saying or interpreting is right. AI is designed to help someone with as many solutions as
possible, so when one person might be asking for a factual answer but not like that type
of answer, it may just spew out misinformation as a means to satisfy the user, and not
actually supplement them with information that is accurate and correct.
4.​ Yes, they do. This is mostly because they’re not really going anywhere and that a good
chunk of the student already uses it, whether it be for studying, writing, or formatting
notes, AI is absolutely a tool that can be taught how to be used and how it should be
implemented into these courses.
Citations
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A52022PC0454&utm_sou
rce=chatgpt.com
https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/?utm_source=c
hatgpt.com
https://cloud.google.com/blog/topics/threat-intelligence/smb-exploited-wannacry-use-of-eternalbl
ue/
https://www.microsoft.com/en-us/industry/blog/healthcare/2017/06/06/wannacry-ransomware-att
ack-lessons-learned/?utm_source=chatgpt.com
https://www.osborneclarke.com/insights/wannacry-cyber-attack-how-will-impending-new-laws-af
fect-security-obligations-and-regulatory-risk?utm_source=chatgpt.com
https://www.microsoft.com/en-us/security/blog/2017/06/27/new-ransomware-old-techniques-pety
a-adds-worm-capabilities/?utm_source=chatgpt.com