What you need to know about the WannaCry malware attack

Written on May 18, 2017

By Adam Mahle, OSCPA systems architect

As you probably know by now, a massive cyberattack using the ransomware known as WannaCry (or WannaCrypt) hit organizations and individuals last weekend on a global scale.

MalwareThe WannaCry attack made headlines on Friday after locking computers in the U.K.'s health system and Spain's largest telecom provider. The attack quickly spread to at least 150 countries including the U.S., Russia, France and Japan.

If you find yourself wondering if this attack is as big a deal as the media seems to be making of it, the answer is yes. If your computer (or any other computer on your network) isn’t patched, your systems could be vulnerable. All your data could be encrypted, and you would have to rely on backups (I hope you have them!) or paying the ransom in an attempt to get your data back. Security analysts said that more than 200 of the WannaCry victims who promptly paid the ransom got their data back. Truthfully, though, cybersecurity experts advise against paying the ransom, as historically only about two-thirds of compliant ransomware victims get their data back after meeting hacker demands.

Ransomware is a developing form of attack, and we will see more of it in the coming months. But other forms of malware are still more prevalent. Most is targeted at stealing information, especially usernames/passwords, credit card numbers and other data that can be used by attackers to help them make money fast.

Assuming you’ve not been attacked already, what should you do now?

  1. If you are using Windows XP or Windows 8, upgrade now because your machines are vulnerable to any future malware (even if Microsoft decided to release a patch after the fact for this issue). Note: A current version of Windows 8.1 is fine, as it is still supported by Microsoft.
  2. Install your windows patches as soon as possible. Don’t wait. The days of waiting weeks, or months to install your patches are over. You need regular updates to patch your systems against vulnerabilities.
  3. Back up your data using either a portable hard drive or a cloud backup service.
  4. Think before you click. Criminals frequently gain access to your computer through “phishing,” or by getting you to click on a link or an attachment in an email. You’re on the web when an unexpected popup tells you to download a PDF. If you’re not sure what it is, don’t download it.
Confirm the legitimacy of attachments, even if they come from a friend or known company. Take the extra few seconds to navigate directly to websites instead of clicking on a questionable link. And be suspicious of warnings or aggressive deadlines: Phishers will often try to push you into acting immediately, and might threaten consequences such as account suspension or additional fees if you don't respond right away.

Leave a comment