← All threat actors
WannaCrymalware / toolS0366 ↗
VirusTotal tracks this as WannaCryptor.
WannaCry is ransomware that was first seen in a global attack during May 2017, which affected more than 150 countries. It contains worm-like features to spread itself across a computer network using the SMBv1 exploit EternalBlue.
Reports / IOCs (VT)
57 reports · 4,134 IOCs
Reported activity
2018 – 2026
ATT&CK techniques in reports
- T1112 Modify Registry3
- T1486 Data Encrypted for Impact3
- T1003.001 LSASS Memory2
- T1070.004 File Deletion2
- T1082 System Information Discovery2
- T1490 Inhibit System Recovery2
- T1548.002 Bypass User Account Control2
- T1562.001 Disable or Modify Tools2
- T1043 Commonly Used Port1
- T1044 File System Permissions Weakness1
- T1045 Software Packing1
- T1055 Process Injection1
- T1179 Hooking1
- T1497 Virtualization/Sandbox Evasion1
- T1021.002 SMB/Windows Admin Shares1
- T1041 Exfiltration Over C2 Channel1
- T1078 Valid Accounts1
- T1190 Exploit Public-Facing Application1
- T1195 Supply Chain Compromise1
- T1485 Data Destruction1
Also known as
WannaCrypt, Wcry, Wana Decrypt0r, WannaCry