WannaCry RansomWare RansomWorm Analysis

FrgMstr

Just Plain Mean
Staff member
2FA
Joined
May 18, 1997
Messages
58,644
It looks as if our in-house security experts were on target when discussing this topic a couple of days ago. Our thoughts were that the subsequent variants of the WannaCry malware were not attached to the original author, as the new variants were coded very sloppily compared to the original coding. This analysis at Performanta makes some very interesting points that are fascinating. They are surmising that the release of the WannaCry RasomWorm may have actually been accidental. While we did not state it publicly last week, the word "anarchists" was thrown around a bit when it came to who was behind the "v2" RansomWorm, which coincides with this analysis.

We also believe there is a reasonable chance the original attack on May the 12th was an accident. The existence of a kill-switch may have been to protect the author(s) in their own analysis environment, and the absence of any newly compiled versions of WannaCry 2.0 shows a lack of commitment from the author(s) to cause more damage or increase their profits.

It remains unknown who the author(s) and/or attacker(s) are behind WannaCry. A question also remains as to whom are responsible for creating and distributing variant II and for what benefit, although the likelihood is simply nothing more than wanting to contribute to the chaos and destruction.
 
Made my last couple days at my security/vulnerability job quite interesting... the most disappointing thing is how long this vulnerability was known and that an MS patch existed since then, and now all of a sudden our customers want to know what in their network is unpatched.

One of the customers even called in when the ShadowBrokers drop regarding this originally happened to make sure our product could tell them about this (which it could). Two months later he calls back in and I see his last case was about the same thing. Good thing the US is serious about "the cyber"...
 
meh.. all i did was drink a load of coffee with my feet on my desk all day while reading about all the people getting f'***ed over, and at some point i sent out an email reminding everyone to not open any fishy emails.
Keep your shit patched guys.
 
It doesn't take a team of in-house security analysts/experts to know there will be copycats, but you can have your cookie.

wanavalve.jpg
 
Might seem like a good idea until you notice that your landing computer is encrypted by the cryptoworm. :p

Who said anything about coming back to this shithole?
 
Back
Top