GINC-APT-1157 · Criminal

WannaCry

Also WanaCrypt0r, WannaCrypt, WCRY, WCrypt.

Category
Criminal · Financially motivated: ransomware, fraud and theft.
Origin
Unknown
Seen
2017
Status
Dormant
Sources
2 sources carry it
Identifier
GINC-APT-1157 · wannacry

What it is

According to numerous open-source reports, a widespread ransomware campaign is affecting various organizations with reports of tens of thousands of infections in as many as 74 countries, including the United States, United Kingdom, Spain, Russia, Taiwan, France, and Japan. The software can run in as many as 27 different languages. The latest version of this ransomware variant, known as WannaCry, WCry, or Wanna Decryptor, was discovered the morning of May 12, 2017, by an independent security researcher and has spread rapidly over several hours, with initial reports beginning around 4:00 AM EDT, May 12, 2017. Open-source reporting indicates a requested ransom of .1781 bitcoins, roughly $300 U.S.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Other names
WanaCrypt0r, WannaCrypt, WCRY, WCrypt

Tools

The tools and malware families the sources tie to it.

  • Archelaus Beta
  • UNITEDRAKE