WannaCry Ransomware
May 2017
Record reviewed: 2026-10-29
Executive Summary
Self-propagating ransomware that exploited the EternalBlue SMB vulnerability to spread across ~150 countries in hours. The UK's National Health Service was among the hardest hit, with hospitals diverting ambulances and cancelling surgeries. A researcher-activated kill switch slowed propagation, but not before substantial global disruption.
Why This Matters
WannaCry exposed how a leaked intelligence exploit can cascade into a global healthcare crisis, sharpening the policy debate on vulnerability disclosure and the duty to protect civilian systems.
Escalation Profile
7-Dimension Profile
Escalation Ladder
Phases
Weaponization of leaked exploit
EternalBlue (leaked from NSA tooling by Shadow Brokers) integrated into a worm-capable ransomware payload.
Global worm propagation
WannaCry spread autonomously via SMBv1, encrypting systems in hospitals, telecoms, railways, and factories across ~150 countries.
Healthcare impact
NHS England diverted ambulances from at least 5 emergency departments; ~19,000 appointments cancelled in one week.
Thresholds Crossed
- •Civilian service harm
- •Unintended spillover
Significance
- •First state-linked ransomware to cause widespread disruption to healthcare services
- •Demonstrated risk of weaponized vulnerability stockpiles entering the wild
Restraint Factors
- •Kill switch domain limited further spread once activated
- •Ransomware payment mechanism was poorly designed, suggesting profit was not the primary motive
Attribution Assessment
Threat actor mapped to North Korea based on infrastructure analysis, malware attribution, and operational patterns.
Evidence: MSRC: Customer Guidance for WannaCrypt Attacks; Nicole Perlroth, This Is How They Tell Me the World Ends (Bloomsbury, 2021)
- •Five Eyes + Japan joint attribution to North Korea (Dec 2017)
- •US DOJ indictment of Park Jin Hyok (Sep 2018)
- •Renewed debate over intelligence agency vulnerability equities processes
Sources: US Treasury: Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups; NHS England: Lessons Learned Review of WannaCry; CISA Alert TA17-132A: Indicators Associated With WannaCry Ransomware; US DOJ: North Korean Regime-Backed Programmer Charged (Park Jin Hyok)
No dedicated journalistic sources in dataset. See sources section for full references.
“Confirmed” reflects available public evidence. All assessments carry inherent uncertainty and should be read alongside source material.
Unpeace Position
Unpeace Score
Severity on the peace–conflict spectrum (1–10): peak tier and thresholds crossed
Governance response (separate axis)
4 formal responses: public attribution, sanctions imposed, indictment, international cooperation. Analyst judgements: norm violation.
Unpeace · score breakdown
6/10Peak tier reached (degradation), ranked 1–6.
From the closed list: civilian service harm, unintended spillover.
1 + 9 × (1.2 × peak + thresholds − 1.2) ÷ 11, rounded (range 1–10, no cap; governance is a separate axis). These weights are an interpretive heuristic, not a validated metric — see the scoring methodology for rationale and limits.
Entanglement · score breakdown
10/10Distinct sectors in targetSectors.
ISO country codes in targetCountries.
Constant offset so a single-sector, single-country event scores 1.
Geographic scope is global, so the score is 10. These weights are an interpretive heuristic, not a validated metric — see the scoring methodology for rationale and limits.
Coercive Function
Ransomware
Denial of access through encryption, coercive value through economic extortion and operational disruption.
Thresholds crossed
- •Civilian service harm
- •Unintended spillover
Entanglement Risk
Sectors affected
Countries / regions
Impact summary
~200,000 systems encrypted in ~150 countries; major disruption to UK NHS, Telefónica, Deutsche Bahn, and others.
Infrastructure Meaning
Malware / tooling
Capability profile
~200,000 systems encrypted in ~150 countries; major disruption to UK NHS, Telefónica, Deutsche Bahn, and others.
3 ATT&CK techniques mapped — see ATT&CK mapping below.
Governance Analysis
Governance Flags
Norms invoked
- •UN GGE 2015 norm against damaging critical infrastructure
- •Duty of care toward healthcare systems in peacetime
Policy responses
- •Five Eyes + Japan joint attribution to North Korea (Dec 2017)
- •US DOJ indictment of Park Jin Hyok (Sep 2018)
- •Renewed debate over intelligence agency vulnerability equities processes
Regulatory changes
- •NHS mandated cyber-resilience upgrades and patching requirements
- •Accelerated global patch-management awareness campaigns
Governance impact assessment
Forced governments to confront the tension between stockpiling vulnerabilities for intelligence and protecting public health infrastructure from the same exploits.
Legal Dimensions
Rules whose application to this operation is debated in the literature. These are analytical questions, not findings — the Atlas records where a case sits in legal debate, it does not adjudicate legality (see methodology §09).
Tallinn Manual 2.0
- Rules 14, 15 and 17, State Responsibility and Attribution
State-linked group (Lazarus) using criminal ransomware tools blurs the state/non-state distinction
Geneva Conventions / IHL
- Principle of Proportionality
NHS disruption affecting patient care raised proportionality concerns even for a state-linked criminal operation
UN GGE Voluntary Norms (2015)
- Norm 13(j), Vulnerability Disclosure
Used leaked NSA exploit, the defining case for vulnerability equities debate
Sources
US Treasury: Treasury Sanctions North Korean State-Sponsored Malicious Cyber Groups
NHS England: Lessons Learned Review of WannaCry
MSRC: Customer Guidance for WannaCrypt Attacks
CISA Alert TA17-132A: Indicators Associated With WannaCry Ransomware
US DOJ: North Korean Regime-Backed Programmer Charged (Park Jin Hyok)
Nicole Perlroth, This Is How They Tell Me the World Ends (Bloomsbury, 2021)
Sources listed reflect publicly available materials used to construct this case entry. Inclusion does not imply endorsement. Where no URL is provided, the source may be found via its title and date.
Related Cases
Colonial Pipeline
May 2021 · Russia (criminal, not directly state-sponsored per US assessment)
Colonial Pipeline proved that criminal ransomware can trigger national-level infrastructure disruptions, collapsing the boundary between cybercrime and national security and forcing mandatory regulation of pipeline cyber defenses.
Costa Rica / Conti
April – May 2022 · Russia (criminal, not directly state-sponsored per public assessments)
Costa Rica showed that ransomware can effectively disable a nation's fiscal and health systems, forcing the first-ever national emergency declaration over a cyber attack and elevating ransomware to a sovereign-level threat.
Change Healthcare
February 2024 · Russia (criminal, possible state nexus)
Change Healthcare demonstrated that a single ransomware attack on a dominant healthcare intermediary can cascade into a national healthcare crisis, making the case for treating healthcare claims infrastructure as critical national infrastructure.
Bangladesh Bank
February 2016 · North Korea
The Bangladesh Bank heist revealed that the global financial messaging system's security depended on its weakest endpoint, and that state actors would exploit that gap to fund sanctioned programs.