The Day WannaCry Hit 150 Countries, and the $10 Domain That Stopped It

On May 12, 2017, hospitals in the UK, train stations in Germany, Telefónica’s offices in Spain, car factories in France and computers in more than 150 countries all showed the same red window: “Ooops, your files have been encrypted!” That was WannaCry, the most famous ransomware attack ever. It spread by itself from PC to PC, using a hacking tool stolen from the NSA, and it was stopped almost by accident by a 22-year-old researcher who registered a weird domain name.

Why WannaCry spread so fast

Most ransomware needs someone to open an email attachment. WannaCry didn’t: it was a worm, which means it could jump from one computer to another on its own, through the network, without anyone clicking anything.

It did that with EternalBlue, an exploit for a bug in SMBv1, the old file-sharing system in Windows. EternalBlue was developed by the US NSA, and it was stolen and leaked online by a hacking group called the Shadow Brokers in April 2017. A month later, it was inside WannaCry.

Once one PC in a company was infected, WannaCry scanned the network and the internet for other PCs with SMB open, and infected them too. That’s how a whole hospital could go down in minutes.

Timeline

What happened on an infected PC

1. WannaCry encrypted documents, photos, videos and other files, and renamed them with a .WNCRY extension.
2. It deleted Windows’ “shadow copies”, the backup versions of files, so they couldn’t be restored easily.
3. It changed the wallpaper and opened the “Wana Decrypt0r 2.0” window, with a countdown and instructions in many languages.
4. The ransom was $300 in Bitcoin. After 3 days it doubled to $600, and after 7 days the files would be lost forever.

In total, victims paid only around $140,000. For an attack of that size, it was a tiny amount, which made many researchers think money wasn’t really the main goal.

My test: WannaCry on Windows 10 (2022)

Back in 2022 I ran WannaCry on Windows 10 to show what a victim actually sees: files getting encrypted, the wallpaper changing and the Wana Decrypt0r window with its countdown. This video is in Spanish:

Honestly, I’ve never had the guts to connect the PC or VM I test it on to the internet. WannaCry is a worm: once it’s on one machine, it scans the network for other PCs to infect, and my test machines would be sitting on the same home network as my family’s computers. Not worth it. Funny enough, staying offline is also what makes the test work at all: the kill switch domain is still registered today, so the original WannaCry just stops if it can reach the internet.

In a future video I want to show the worm part properly: three PCs connected to each other on a closed network, with no internet and nothing else plugged in, to see WannaCry jump from one to the next on its own.

The kill switch: how a domain name saved the internet

A British researcher called Marcus Hutchins (known online as MalwareTech) was analysing WannaCry and noticed that, before doing anything, it tried to connect to a very long, random-looking web address that didn’t exist.

He registered that domain for about $10, mostly to track the infections. Then something unexpected happened: new infections stopped. WannaCry was programmed to stop if that domain existed. It was probably a trick to avoid security sandboxes, but it worked as a kill switch. That one domain slowed down the attack enormously and gave companies time to patch.

The UK’s NHS

The most famous victim was the UK’s National Health Service. About a third of hospital trusts in England were affected, around 19,000 appointments and operations were cancelled, and some ambulances had to be sent to other hospitals. Many of the infected computers were running old, unpatched versions of Windows. The UK later estimated the cost at about £92 million.

The Windows XP myth

A lot of news blamed Windows XP, but researchers found that almost all infected PCs were actually running Windows 7. Funny enough, on XP WannaCry usually just crashed the PC instead of encrypting it. The real problem wasn’t old Windows, it was missing updates: the fix had been available for two months.

Could it happen again?

The single biggest lesson is boring: install Windows updates. Every PC that had the March 2017 update was safe from the worm. A few other things close the doors WannaCry used:

• Turn off SMBv1 if it’s still enabled on old systems (Windows 10 and 11 have it off by default).
• Never expose file sharing to the internet: port 445 should never be open on your router.
• Keep a backup that isn’t connected to the PC, like an external drive you unplug afterwards.
• Move off unsupported systems. Windows 10 stopped getting free updates in October 2025, and if your PC “can’t” run Windows 11, check my guide on installing Windows 11 on an unsupported PC.