Critical Windows Exploit – Targeted by Ransomware

The WannaCry ransomware worm, aka WanaCypt0r aka WCry, today spread rapidly over the internet. The worm targets mainly machines in Russia, Ukraine, India and Taiwan initially. However it has a footprint in about 74 countries. Once infected, a machine will also attempt to infect other clients on the same local network. So if you have a machine infected, isolate it immediately to prevent it from spreading.

WannaCry is installed on Windows computers by a worm that spreads across networks by exploiting a vulnerability in Microsoft’s SMB file-sharing services. It specifically abuses a bug designated MS17-010 that Redmond patched in March for modern versions of Windows – unpatched systems, or ones running legacy versions such as Windows XP, are therefore vulnerable and can be attacked.

This was released back in April as part of a leak regarding NSA that publicize the bug and a tool used to exploit it. Hackers have now made use of the tool and strapped it to ransomware.

Further Details are below:

  • In March, Microsoft released a security update which addresses the vulnerability that these attacks are exploiting.
  • For customers using Windows Defender, Microsoft has released an update earlier today which detects this threat as Ransom:Win32/WannaCrypt. Make sure all antivirus / anti-malware software are up to date. Clients running anti-malware software from any number of security companies can confirm with their provider if they are protected.
  • Clients should consider blocking legacy protocols on their networks such as SMBv1.
  • Clients who do not need to mount to network shares should considered disabling by default the SMB service. For newer versions of Windows, you can specifically remove SMBv1 by removing the feature.
  • This impact systems as old as Windows XP. So all your machines including desktops could technically be at risk.

All our Managed Clients running Windows are already protected as we regularly update your system as patches become available.

If you have any questions regarding this exploit or how to implement some of the recommendations above, please feel free to open a ticket with our support: https://www.sprintserve.net/support.