Law enforcement agencies recently discovered a spam campaign that leverages the threat of WannaCry to extort unsuspecting users, once again highlighting the need for organizations to patch systems and address lingering risks that make them susceptible to ransomware.
Investigators analyzed 300 reports of the campaign between June 21 and 22, 2018, and found that the attackers attempted to cause panic by warning recipients that their devices had been infected with the devastating crypto-ransomware. This same ransomware struck organizations in more than 100 countries in May 2017.
The spam messages claimed the attackers would delete every piece of data on the infected devices sometime during the evening of June 22, 2018. The only way victims could save their data, according to the malicious emails, was to pay 0.1 bitcoin — roughly $650 — to an attacker-controlled wallet and notify the threat group of payment by a certain time on that date.
An Empty Threat Offers a Pregnant Warning
Active Fraud, the U.K. national fraud and cybercrime reporting center that observed the campaign, explained that the emails are in reality a phishing exercise in that they spread fear — nothing more. But although this particular spam campaign doesn’t actually drop WannaCry, it’s conceivable that another operation could.
Supporting this notion is the fact that organizations are not automatically safe from WannaCry just because of the existence of the kill switch. Security firm Kryptos Logic observed approximately 100 million connection attempts from 2.7 million unique IP addresses over the kill switch in March 2018. This discovery indicates that the ransomware attempted to connect to the kill switch domain from millions of infected computers in order to proceed with encryption. It failed because of the registration of the kill switch, but it’s clear that WannaCry is still infecting machines and, by extension, trying to deny users and organizations access to their own data.
“We estimate a wide variety of hundreds of thousands of untreated and dormant Microsoft Windows infections maintain a foothold and are responsible for the residual and continued propagation of WannaCry, which by our data set analysis and estimates reach several (potentially tens of) million systems through an ebb and flow infection cycle every month,” the researchers explained.
The firm then presented scenarios in which the ransomware could still theoretically infect a company. In one scenario, an asset that’s still vulnerable to the EternalBlue Server Message Block (SMB) exploit could lay the foundation for an attack in the presence of dormant infection. Another involves a network segmentation failure.
Tips to Keep WannaCry at Bay
The bottom line: WannaCry still poses a threat to organizations. To mitigate the risk, organizations should scan their environments for vulnerable SMB services and monitor their endpoints for indicators of compromise associated with the ransomware. Users should also continuously update their antivirus software, avoid engaging with fraudsters over email and report suspicious messages to law enforcement.