WannaCry Ransomware 2017 Incident Report Details
"Explore the incident report on the WannaCry Ransomware 2017 attack that affected over 200,000 devices across 150 countries. Learn about the significance, threat actors, recommendations for next steps, and sources for further information."
Uploaded on | 0 Views
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Students: This Incident Report provides you with an example of the information your report would contain. It reports on a different incident than your Course 3 Capstone and is provided as a courtesy to demonstrate the content found in an Incident Report. WannaCry Ransomware 2017
WannaCry Ransomware Summary & Significance Compromised over 200,000 devices across 150 countries Unique in that it was a worm with quick movement of self-replicating qualities Exploited the Windows SMB protocol (CVE-2017-0147) Wannacry malware tried to access a hard-coded URL which was an unclaimed domain Later halted by hacker Marcus Hutchins who bought this and redirected its activity
Threat Actors The Bad Guys Suspected to have been conducted by a group known as Lazarus Group Affiliated to the North Korean government The Good Guys Halted by hacker Marcus Hutchins who bought the actual domain the malware C2 attempted to ping and redirected its activity
Recommendations for Next Steps Have a vulnerability management program with patching protocols in place Implement security awareness training program for all users Install the Windows security update for MS17-010 on all systems on the network Disable version 1 of SMB (SMBv1) in the Windows domain or on all Windows systems on the network
Sources Mailspike Technologies. 16 May 2017. https://www.anubisnetworks.com/blog/how-to-protect-against- wannacry-ransomware NVD. 20 June 2018. https://nvd.nist.gov/vuln/detail/CVE-2017-0147
