WannaCry Ransomware Outbreak

Incident Overview

WannaCry was a self-propagating worm and ransomware strain that hit global networks in May 2017. It generated a unique AES key per file, encrypted the file, and encrypted the AES key using an embedded RSA-2048 public key.

Technical Root Cause Analysis

Exploited SMBv1 vulnerability (MS17-010 / EternalBlue) to spread autonomously across internal networks, encrypting user files with AES-128 and protecting the key with a master RSA-2048 public key.

• Hybrid Encryption Architecture: Encrypted files with AES-128-CBC. Each file key was encrypted using a local RSA-2048 public key generated per infected host.
• Master Public Key: Local RSA keypair private component was encrypted with hardcoded master attacker RSA-2048 public key.
• Worm Mechanism: Scanned random public IP addresses and internal subnets on TCP port 445 (SMB) to inject EternalBlue payload.

WannaCry Cryptographic Flow (Pseudocode)

// Generate 128-bit random AES key per file
CryptGenRandom(hProv, 16, aes_key);

// Encrypt file contents with AES-128-CBC
AES_encrypt_file(target_file, aes_key);

// Encrypt AES key with local host RSA-2048 public key
RSA_public_encrypt(16, aes_key, encrypted_aes_key, hLocalRsaPubKey);

Incident Timeline