itb-au logo
Story image

From predator to high-risk vaccine: Sophos tracks WannaCry's evolution

23 Sep 2019

Network and endpoint security service provider Sophos has published WannaCry Aftershock, a report on what happened to the infamous WannaCry malware, following the worldwide attack that began on May 12, 2017.

The research by SophosLabs shows that the WannaCry threat remains rampant, with millions of infection attempts stopped every month, and that while the original malware has not been updated, many thousands of short-lived variants are in the wild.

The continued existence of the WannaCry threat is largely due to the ability of these new variants to bypass the kill switch.

However, when Sophos researchers analysed and executed a number of variant samples, they found that their ability to encrypt data was neutralised as a result of code corruption.

Because of the way in which WannaCry infects new victims checking to see if a computer is already infected and, if so moving on to another target infection by an inert version of the malware effectively protects the device from being infected with the active strain.

In short, new variants of the malware act as an accidental vaccine, offering still unpatched and vulnerable computers a sort of immunity from subsequent attack by the same malware.

However, the very fact that these computers could be infected in the first place suggests the patch against the main exploit used in the WannaCry attacks has not been installed a patch that was released more than two years ago.

The original WannaCry malware was detected just 40 times and since then SophosLabs researchers have identified 12,480 variants of the original code.

Closer inspection of more than 2,700 samples (accounting for 98% of the detections) revealed they had all evolved to bypass the kill switch a specific URL that, if the malware connects to it, automatically ends the infection process and all had a corrupted ransomware component and were unable to encrypt data.

In August 2019, Sophos telemetry detected 4.3 million instances of WannaCry.

The number of different variants observed was 6,963.

Of these, 5,555 or 80% were new files.

Sophos researchers have also traced the first appearance of today’s most widespread corrupted variant back to just two days after the original attack: May 14, 2017, when it was uploaded to VirusTotal, but had not yet been seen in the wild.

“The WannaCry outbreak of 2017 changed the threat landscape forever. Our research highlights how many unpatched computers are still out there, and if you haven’t installed updates that were released more than two years ago – how many other patches have you missed?" says Sophos security specialist and the research lead author Peter Mackenzie.

“In this case, some victims have been lucky because variants of the malware immunised them against newer versions. But no organisation should rely on this.

"Instead, standard practice should be a policy of installing patches whenever they are issued, and a robust security solution in place that covers all endpoints, networks and systems,” he adds.

How to protect against WannaCry malware and ransomware in general

  • Check that you have a full inventory of all devices connected to your network and that they are all up to date in terms of their security software
  • Always install the latest patches as soon as they are released on all the devices on your network
  • Verify if your computers are patched against the EternalBlue exploit used in WannaCry by following these instructions.
  • Keep regular backups of your most important and current data on an offline storage device as the best way to avoid having to pay a ransom when affected by ransomware
Story image
Organisations struggling to realise full business value from cloud investments
“Our study shows a surprisingly small two-year improvement in returns on corporate cloud initiatives, suggesting that a more thoughtful and holistic approach is needed to fully unlock the value of cloud.”More
Story image
Environmental Intelligence sector increasingly important, report states
The EI sector is emerging as one where technology meets real-world challenges, and is set to become more significant as climate change and environmental issues dominate public interest, the report states.More
Story image
How to keep office equipment safe in the COVID-19 era
In addition to basic hygiene procedures like mandating the use of hand sanitiser and encouraging the use of masks, organisations can minimise the risk of cross-contamination and infection when employees are using shared devices.More
Story image
Video: 10 Minute IT Jams - Who is OutSystems?
In this IT Jam, we speak with OutSystems vice president for A/NZ Paul Arthur, who discusses the company's role in the A/NZ region, how things have changed for the company and the industry amid pandemic, and what he sees in the future of visual development and digital transformation.More
Story image
Trintech expands Australian Data Centre and makes additions to local team
"This investment enables mid-market companies in the APAC region to leverage Trintech's industry-leading financial close solution, Adra, in complete compliance with onshore data requirements."More
Story image
New Linius solution enables search and assembly of video meeting clips
The new product, “WHIZZARD”, will soon be available to Zoom, Webex and Microsoft Teams users.More