{"id":84432,"date":"2017-06-22T12:47:59","date_gmt":"2017-06-22T07:17:59","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=84432"},"modified":"2017-06-22T12:47:59","modified_gmt":"2017-06-22T07:17:59","slug":"wannacrys-never-say-die-attitude-keeps-going","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/wannacrys-never-say-die-attitude-keeps-going\/","title":{"rendered":"WannaCry’s Never Say Die Attitude Keeps It Going!"},"content":{"rendered":"

Over the past few months, the cybersecurity world was at buzz due to the infamous WannaCry<\/a> ransomware attack. The attack was launched on a massive scale. The campaign started after the disclosure of NSA exploit leak by a hacker group called Shadow Brokers<\/a>. Taking advantage of unpatched systems all over the globe, the attack spread across 150 countries. The WannaCry ransomware attack sought the exploit called \u2018EternalBlue\u2019. The worm-like functionality of this exploit made a deadlier impact by propagating to interconnected computers over Windows SMB<\/a> protocol. Microsoft\u2019s security bulletin MS17-010<\/a> addresses the vulnerabilities exploited in this particular attack.<\/p>\n

This blog post will give an insight into the attack\u2019s timeline and recent observations made around its existence till date.<\/p>\n

Here is how it happened<\/strong><\/p>\n

\"Fig
Fig 1. Timeline of WannaCry ransomware attack<\/figcaption><\/figure>\n

On April 8, 2017, the NSA leaked exploits were made publically available by the Shadow Broker group. A week later, Microsoft issued a blog<\/a> post stating its patches for the vulnerabilities targeted in the leaked NSA exploits. The exploits used in the WannaCry attack were patched in MS17-010<\/a> security bulletin released on March 14, 2017. As it\u2019s quite visible from the above timeline (see Fig 1.), Quick Heal and Seqrite products were having the IDS\/IPS detections to detect \u2018EternalBlue\u2019 and other exploits way before the first report of WannaCry got reported. Quick Heal Security Labs released an IDS\/IPS advisory<\/a> on May 13, 2017, to address this issue.<\/p>\n

In addition to IDS\/IPS (network based) detections, other detection mechanisms present in Quick Heal and Seqrite products were capable of detecting the WannaCry ransomware. This was the perfect example of how multi-layered security products such as Quick Heal and Seqrite could mitigate such severe attacks. The below-mentioned features played a crucial role in dealing with this attack.<\/p>\n