Wannacry Ransomware

The WannaCry ransomware attack is an ongoing worldwide cyberattack by the WannaCry ransomware cryptoworm, which targets computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in the Bitcoin cryptocurrency.

The attack started on Friday, 12 May 2017,and has been described as unprecedented in scale, infecting more than 230,000 computers in over 150 countries. Parts of Britain's National Health Service (NHS), Spain's Telefónica, FedEx and Deutsche Bahn were hit, along with many other countries and companies worldwide.

WannaCry spreads across local networks and the Internet to systems that have not been updated with recent security updates, to directly infect any exposed systems. To do so it uses the EternalBlue exploit developed by the U.S. National Security Agency (NSA), which was released by The Shadow Brokers two months before. A "critical" patch had been issued by Microsoft on 14 March 2017 to remove the underlying vulnerability for supported systems, nearly two months before the attack, but many organizations had not yet applied it. Those still running exposed older, unsupported operating systems such as Windows XP and Windows Server 2003, were initially at particular risk but the day after the outbreak Microsoft took the unusual step of releasing updates for these operating systems too. Almost all victims are running newer Windows 7.

Shortly after the attack began, a web security researcher who blogs as "MalwareTech" discovered an effective kill switch by registering a domain name he found in the code of the ransomware. This greatly slowed the spread of the infection, but new versions have since been detected that lack the kill switch. As per official news agencies reports, the cyberattack has slowed down drastically and has died down as of 19 May 2017.

Here is the screenshot of the victims Pc.

How it infects the PCs/Servers :

• Via Phishing e-mail 
• Via Network through other infected PCs

What are the symptoms that you can identify that your PC is hit by this ransomware or not.

• Your PC may be crashing repetitively.
• Occurring of blue screen.
• PC may get slow.

What you can do  if your PC is infected by this ransomware:

1. Disconnect your PC from the network immediately (cable or WiFi).
2. Backup your critical data on a non-connected external drive.
3. Do not connect the drive to the network until further notice.
4. Contact immediately 2929 IT support.
5. Contact on-site support for those PCs not on anti-virus platform.

How to prevent infection form this virus:

• Do not click on any suspicious link.
• Do not open any attachment in an e-mail providing unsolicited information.
• Double check on the origin of the e-mail sender. The e-mail sender name may seem legitimate, but e-mail address can show the mail is malicious.
•  Apply information Security Charter rules with utmost rigour.
• Apply all security patches pushed to your PCs by the IPO Team.

 This is how the Ransomware works.