Ransomware · May 12, 2017 · 5 min
WannaCry: a Friday in 2017 when British hospitals lost their systems
MedellínSoftware · Medellín, Colombia
May 12. The ransomware used a leaked NSA tool. The NHS cancelled appointments and diverted ambulances. Washington and London attributed it to North Korea.
medellinsoftware.com/story/wannacry-hospitales-reino-unido/
Day
May 12, 2017
Vector
EternalBlue
Visible victim
NHS
Attribution
Lazarus
On May 12, 2017, hospital screens in England turned red. WannaCry encrypted and asked for bitcoin. About eighty NHS organizations were hit: surgeries moved, ambulances diverted, records unreadable.
The worm was not elegant. It used EternalBlue, a Windows exploit the NSA had kept and a group leaked weeks earlier. Microsoft already had a patch. Half the world had not installed it.
A researcher, Marcus Hutchins, registered a domain the malware checked. That tripped a kill switch and slowed the spread. The United States, the United Kingdom, and others attributed the campaign to Lazarus, the North Korean apparatus.
What remains is not the bitcoin. It is an emergency room running on paper because the digital chart would no longer open.
The desk
The file is public. The briefing is requested.
AI and deep military intelligence. Medellín.