Definition: WannaCry

Ransomware that exploited a vulnerability in Windows PCs in 2017. Also called "Wanna Decryptor," WannaCry is believed to be of Chinese origin. It infected about 200,000 computers worldwide that mostly ran Windows 7. WannaCry was a worm that replicated itself.

The National Health Services in the U.K. was hard hit with thousands of compromised computers and medical devices. Hardly anyone got their computer restored after paying the $300 ransom, and it cost companies an estimated $4 billion to restore their systems. Although there was a Windows patch that would have prevented WannaCry, the infected computers were apparently not updated.

The Weird Kill Switch
The strange thing about WannaCry was that it had a kill switch. When first executed, it queried a mysterious URL. If WannaCry could not connect to that domain, it encrypted the files and demanded ransom. When security analysts registered the URL and created a website with a home page, WannaCry stopped infecting new computers. See ransomware and worm.

Oops, your files have been encrypted!

This was the WannaCry message users saw after their computers were infected. With imperfect English such as "but you have not so enough time" was a sure sign WannaCry was of foreign origin.