{"id":447,"date":"2018-05-22T22:57:58","date_gmt":"2018-05-22T22:57:58","guid":{"rendered":"https:\/\/eset-blog.aist.fun\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/"},"modified":"2019-05-29T12:46:54","modified_gmt":"2019-05-29T12:46:54","slug":"12-months-on-what-are-the-lessons-learned-from-wannacryptor","status":"publish","type":"post","link":"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/","title":{"rendered":"12 months on, what are the lessons learned from WannaCryptor?"},"content":{"rendered":"<p>Time does fly! It feels like only yesterday that a new strain of hitherto little-known malware achieved celebrity status among global ransomware campaigns.<\/p>\n<p>It\u2019s already been a year, almost to the day, since the WannaCryptor ransomware cryptoworm \u2013 also known as WannaCry and detected by ESET as&nbsp;<a href=\"http:\/\/www.virusradar.com\/en\/Win32_Filecoder.WannaCryptor.D\/description\">Win32\/Filecoder.WannaCryptor.D<\/a>&nbsp;\u2013 ran rampant. What made WannaCryptor\u2019s impact so severe, especially when the ransomware component of the malware was rather run-of-the-mill?<\/p>\n<p>The global outbreak was clearly a teachable moment, as the factors that contributed to its large footprint also revealed some powerful lessons. We\u2019ll spare you an introduction or a repetition of the&nbsp;<a href=\"https:\/\/www.welivesecurity.com\/2017\/05\/15\/wannacryptor-key-questions-answered\/\">well-known facts<\/a>, so that we can instead dive right into lessons learned from the global outbreak. There\u2019s no other way to begin than with takeaways stemming from how WannaCryptor took root and fanned out.<\/p>\n<h2><strong>Patch me if you can<\/strong><\/h2>\n<p>Put simply, for the defenders, holes are there to be plugged. Put just as simply but differently, it\u2019s a \u201cpatch-or-perish world\u201d, especially regarding fixes for known security flaws. The merits of&nbsp;<a href=\"https:\/\/www.welivesecurity.com\/2017\/05\/16\/check-eternalblue-pc-patched-wannacryptor-worm-vulnerability\/\">timely patching<\/a>&nbsp;become even more apparent when we consider that the&nbsp;<a href=\"https:\/\/docs.microsoft.com\/en-us\/security-updates\/SecurityBulletins\/2017\/ms17-010\">fix<\/a>&nbsp;for the flaw exploited in the WannaCryptor campaign had been released almost two months before the malware grabbed the headlines.<\/p>\n<p>However, many organizations struggle to keep their systems current. To be sure, business realities often mean that installing fixes across enterprise environments is no easy task. Whatever the cause of this perennial problem, however, the upshot is the same: with every patch waiting to be deployed, the&nbsp;<a href=\"https:\/\/www.welivesecurity.com\/2018\/04\/19\/patching-shut-window-unpatched\/\">window of opportunity<\/a>&nbsp;becomes ever more open to intruders.<\/p>\n<h2><strong>Out of date, out of breath?<\/strong><\/h2>\n<p>Some victims were hit not because they hadn\u2019t patched, but because a fix was impossible, or at least intractable. That is, they were running systems that had reached the end of their lifespans and, in the absence of mainstream support, no patch was available. In that case, replacing outdated and legacy systems should be the overarching concern. If that isn\u2019t possible immediately, the old systems should be, whenever possible, isolated on their own network segments.<\/p>\n<h2><strong>Defanging and starving out the worm<\/strong><\/h2>\n<p>In fact, security-minded network segmentation in general can harden a firm\u2019s defenses, especially against malware exhibiting worm-like behavior as was the case with WannaCryptor. By permitting only certain traffic in and out of functional segments and between one another, as well as by securing data during lateral movements, even if a breach does occur on one segment, the exposure is limited and the damage is contained. As an added benefit, network compartmentalization allows for stronger access controls, restricting access to sub-networks only to employees who need it, and only with permissions that they really need.<\/p>\n<h2><strong>Turn off what\u2019s not needed<\/strong><\/h2>\n<p><a class=\"fancybox\"  href=\"https:\/\/www.welivesecurity.com\/wp-content\/uploads\/2018\/05\/12Months_TurnOff.jpg\" data-rel=\"lightbox-gallery-0\" data-rl_title=\"\" data-rl_caption=\"\" data-magnific_type=\"gallery\" data-fancybox=\"single-post-fancybox\" title=\"\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-111507\" src=\"https:\/\/www.welivesecurity.com\/wp-content\/uploads\/2018\/05\/12Months_TurnOff.jpg\" sizes=\"auto, (max-width: 1000px) 100vw, 1000px\" srcset=\"https:\/\/www.welivesecurity.com\/wp-content\/uploads\/2018\/05\/12Months_TurnOff.jpg 1000w, https:\/\/www.welivesecurity.com\/wp-content\/uploads\/2018\/05\/12Months_TurnOff-300x200.jpg 300w, https:\/\/www.welivesecurity.com\/wp-content\/uploads\/2018\/05\/12Months_TurnOff-768x512.jpg 768w, https:\/\/www.welivesecurity.com\/wp-content\/uploads\/2018\/05\/12Months_TurnOff-65x42.jpg 65w, https:\/\/www.welivesecurity.com\/wp-content\/uploads\/2018\/05\/12Months_TurnOff-114x76.jpg 114w, https:\/\/www.welivesecurity.com\/wp-content\/uploads\/2018\/05\/12Months_TurnOff-97x65.jpg 97w\" alt=\"\" width=\"1000\" height=\"667\"><\/a><\/p>\n<p>The campaign propagated via the long-outdated, first version of Microsoft\u2019s file-sharing Server Message Block (SMBv1) protocol, so it goes without saying that the protocol\u2019s ancient version should be disabled altogether \u2013 as&nbsp;<a href=\"https:\/\/blogs.technet.microsoft.com\/filecab\/2016\/09\/16\/stop-using-smb1\/\">advised by Microsoft<\/a>&nbsp;itself back in 2016, after all. In addition, SMB, in any of its three versions, is used on ports that&nbsp;<a href=\"https:\/\/support.microsoft.com\/en-us\/help\/3185535\/guidelines-for-blocking-specific-firewall-ports-to-prevent-smb-traffic\">shouldn\u2019t be exposed to the open internet<\/a>&nbsp;at all. At the end of the day, it never hurts to enable only the services that are needed while turning off all others.<\/p>\n<h2><strong>Anti-malware software exists for a reason<\/strong><\/h2>\n<p>Robust cybersecurity controls involve ensuring that all machines are fitted with security software that, naturally, needs to be kept up-to-date. A robust anti-malware suite incorporates complementary layers of defense that kick in at different stages of the cyber-kill-chain, helping protect even against flaws for which a patch has not been released or deployed \u2013 or even developed. As reported in&nbsp;<a href=\"https:\/\/www.welivesecurity.com\/2017\/05\/18\/protected-against-wannacryptor\/\">one of our blog posts<\/a>&nbsp;soon after the pandemic broke out, ESET detected and blocked attempts to abuse the SMB vulnerability before this particular strain of malware was even created.<\/p>\n<h2><strong>Back up (and put backups to the test)<\/strong><\/h2>\n<p>Last, but absolutely not least \u2013 backups. Indeed, in this scenario, backups only come into play as a last-ditch measure after all the cyberdefenses are breached, but that happens to underscore their importance. Indeed, if the worst comes to the worst, a successful incident response and recovery will hinge on a tried-and-tested backup strategy. This routine needs to include making frequent copies of data to media that are normally offline, thus keeping them safe from the malware\u2019s reach. That way, there is no need to ponder the possibility of giving in to the attackers\u2019 demands \u2013 an idea that we generally&nbsp;<a href=\"https:\/\/www.welivesecurity.com\/2015\/10\/30\/ransomware-pay-not-pay\/\">advise against<\/a>, anyway. Additionally, in this case, paying up was&nbsp;<a href=\"https:\/\/www.welivesecurity.com\/2018\/03\/07\/ransomware-revolution\/\">very unlikely<\/a>&nbsp;to be of any help.<\/p>\n<h2><strong>Picking the (ultimately) easier way<\/strong><\/h2>\n<p>Regardless of how demanding precautions are, they are nowhere near as difficult as all that needs to be done when dealing with the consequences of a serious incident. This old adage clearly continues to hold true even after the hue and (Wanna)Cry(ptor) has all but died down.<\/p>\n<p>Which surely makes you wonder: whatever happened to the exploit \u2013 EternalBlue \u2013 that enabled the campaign in the first place? Wonder no more, we\u2019ve got that covered. However, our own Ondrej Kubovi\u010d finds that, sadly, that one is&nbsp;<a href=\"https:\/\/www.welivesecurity.com\/2018\/05\/10\/one-year-later-eternalblue-exploit-wannacryptor\/\">alive and kicking<\/a>.<\/p>\n<p>Should that still not satiate your curiosity, be sure to read our piece about facts you may not have known about WannaCryptor next week.<\/p>\n<p><span style=\"border-top-left-radius: 2px; border-top-right-radius: 2px; border-bottom-right-radius: 2px; border-bottom-left-radius: 2px; text-indent: 20px; width: auto; padding: 0px 4px 0px 0px; text-align: center; font-style: normal; font-variant-caps: normal; font-weight: bold; font-stretch: normal; font-size: 11px; line-height: 20px; font-family: 'Helvetica Neue', Helvetica, sans-serif; color: #ffffff; background-image: url(data:image\/svg+xml; base64,phn2zyb4bwxucz0iahr0cdovl3d3dy53my5vcmcvmjawmc9zdmciighlawdodd0imzbwecigd2lkdgg9ijmwchgiihzpzxdcb3g9ii0xic0xidmxidmxij48zz48cgf0acbkpsjnmjkundq5lde0ljy2mibdmjkundq5ldiyljcymiaymi44njgsmjkumju2ide0ljc1ldi5lji1nibdni42mzismjkumju2idaumduxldiyljcymiawlja1mswxnc42njigqzaumduxldyunjaxidyunjmyldaumdy3ide0ljc1ldaumdy3iemymi44njgsmc4wnjcgmjkundq5ldyunjaxidi5ljq0oswxnc42njiiigzpbgw9iinmzmyiihn0cm9rzt0ii2zmziigc3ryb2tllxdpzhropsixij48l3bhdgg+phbhdgggzd0itte0ljczmywxljy4nibdny41mtysms42odygms42njusny40otugms42njusmtqunjyyiemxljy2nswymc4xntkgns4xmdksmjquodu0idkuotcsmjyunzq0iem5ljg1niwyns43mtggos43ntmsmjqumtqzidewljaxniwymy4wmjigqzewlji1mywymi4wmsaxms41ndgsmtyuntcyidexlju0ocwxni41nzigqzexlju0ocwxni41nzigmteumtu3lde1ljc5nsaxms4xntcsmtqunjq2iemxms4xntcsmtiuodqyideyljixmswxms40otugmtmuntiyldexljq5nsbdmtqunjm3ldexljq5nsaxns4xnzusmtiumzi2ide1lje3nswxmy4zmjmgqze1lje3nswxnc40mzygmtqundyylde2ljegmtqumdkzlde3ljy0mybdmtmunzg1lde4ljkznsaxnc43ndusmtkuotg4ide2ljayocwxos45odggqze4ljm1mswxos45odggmjaumtm2lde3lju1niaymc4xmzysmtqumdq2iemymc4xmzysmtauotm5ide3ljg4ocw4ljc2nyaxnc42nzgsoc43njcgqzewljk1osw4ljc2nya4ljc3nywxms41mzygoc43nzcsmtqumzk4iem4ljc3nywxns41mtmgos4ymswxni43mdkgos43ndksmtcumzu5iem5ljg1niwxny40odggos44nzismtcunia5ljg0lde3ljczmsbdos43ndesmtgumtqxidkuntismtkumdizidkundc3lde5ljiwmybdos40miwxos40nca5lji4ocwxos40otegos4wncwxos4znzygqzcunda4lde4ljyymia2ljm4nywxni4yntigni4zodcsmtqumzq5iem2ljm4nywxmc4yntygos4zodmsni40otcgmtuumdiyldyundk3iemxos41ntusni40otcgmjmumdc4ldkunza1idizlja3ocwxmy45otegqzizlja3ocwxoc40njmgmjaumjm5ldiylja2miaxni4yotcsmjiumdyyiemxnc45nzmsmjiumdyyidezljcyocwyms4znzkgmtmumzayldiwlju3mibdmtmumzayldiwlju3miaxmi42ndcsmjmumdugmtiundg4ldizljy1nybdmtiumtkzldi0ljc4ncaxms4zotysmjyumtk2idewljg2mywyny4wntggqzeylja4niwyny40mzqgmtmumzg2ldi3ljyznyaxnc43mzmsmjcunjm3iemyms45nswyny42mzcgmjcuodaxldixljgyocayny44mdesmtqunjyyiemyny44mdesny40otugmjeuotusms42odygmtqunzmzldeunjg2iibmawxspsijymqwodfjij48l3bhdgg+pc9npjwvc3znpg==); background-size: 14px 14px; background-color: #bd081c; position: absolute; opacity: 1; z-index: 8675309; display: none; cursor: pointer; border: none; -webkit-font-smoothing: antialiased; top: 2026px; left: 50px; background-position: 3px 50%; background-repeat: no-repeat no-repeat;\">Save<\/span><span style=\"border-top-left-radius: 2px; border-top-right-radius: 2px; border-bottom-right-radius: 2px; border-bottom-left-radius: 2px; text-indent: 20px; width: auto; padding: 0px 4px 0px 0px; text-align: center; font-style: normal; font-variant-caps: normal; font-weight: bold; font-stretch: normal; font-size: 11px; line-height: 20px; font-family: 'Helvetica Neue', Helvetica, sans-serif; color: #ffffff; background-image: url(data:image\/svg+xml; base64,phn2zyb4bwxucz0iahr0cdovl3d3dy53my5vcmcvmjawmc9zdmciighlawdodd0imzbwecigd2lkdgg9ijmwchgiihzpzxdcb3g9ii0xic0xidmxidmxij48zz48cgf0acbkpsjnmjkundq5lde0ljy2mibdmjkundq5ldiyljcymiaymi44njgsmjkumju2ide0ljc1ldi5lji1nibdni42mzismjkumju2idaumduxldiyljcymiawlja1mswxnc42njigqzaumduxldyunjaxidyunjmyldaumdy3ide0ljc1ldaumdy3iemymi44njgsmc4wnjcgmjkundq5ldyunjaxidi5ljq0oswxnc42njiiigzpbgw9iinmzmyiihn0cm9rzt0ii2zmziigc3ryb2tllxdpzhropsixij48l3bhdgg+phbhdgggzd0itte0ljczmywxljy4nibdny41mtysms42odygms42njusny40otugms42njusmtqunjyyiemxljy2nswymc4xntkgns4xmdksmjquodu0idkuotcsmjyunzq0iem5ljg1niwyns43mtggos43ntmsmjqumtqzidewljaxniwymy4wmjigqzewlji1mywymi4wmsaxms41ndgsmtyuntcyidexlju0ocwxni41nzigqzexlju0ocwxni41nzigmteumtu3lde1ljc5nsaxms4xntcsmtqunjq2iemxms4xntcsmtiuodqyideyljixmswxms40otugmtmuntiyldexljq5nsbdmtqunjm3ldexljq5nsaxns4xnzusmtiumzi2ide1lje3nswxmy4zmjmgqze1lje3nswxnc40mzygmtqundyylde2ljegmtqumdkzlde3ljy0mybdmtmunzg1lde4ljkznsaxnc43ndusmtkuotg4ide2ljayocwxos45odggqze4ljm1mswxos45odggmjaumtm2lde3lju1niaymc4xmzysmtqumdq2iemymc4xmzysmtauotm5ide3ljg4ocw4ljc2nyaxnc42nzgsoc43njcgqzewljk1osw4ljc2nya4ljc3nywxms41mzygoc43nzcsmtqumzk4iem4ljc3nywxns41mtmgos4ymswxni43mdkgos43ndksmtcumzu5iem5ljg1niwxny40odggos44nzismtcunia5ljg0lde3ljczmsbdos43ndesmtgumtqxidkuntismtkumdizidkundc3lde5ljiwmybdos40miwxos40nca5lji4ocwxos40otegos4wncwxos4znzygqzcunda4lde4ljyymia2ljm4nywxni4yntigni4zodcsmtqumzq5iem2ljm4nywxmc4yntygos4zodmsni40otcgmtuumdiyldyundk3iemxos41ntusni40otcgmjmumdc4ldkunza1idizlja3ocwxmy45otegqzizlja3ocwxoc40njmgmjaumjm5ldiylja2miaxni4yotcsmjiumdyyiemxnc45nzmsmjiumdyyidezljcyocwyms4znzkgmtmumzayldiwlju3mibdmtmumzayldiwlju3miaxmi42ndcsmjmumdugmtiundg4ldizljy1nybdmtiumtkzldi0ljc4ncaxms4zotysmjyumtk2idewljg2mywyny4wntggqzeylja4niwyny40mzqgmtmumzg2ldi3ljyznyaxnc43mzmsmjcunjm3iemyms45nswyny42mzcgmjcuodaxldixljgyocayny44mdesmtqunjyyiemyny44mdesny40otugmjeuotusms42odygmtqunzmzldeunjg2iibmawxspsijymqwodfjij48l3bhdgg+pc9npjwvc3znpg==); background-size: 14px 14px; background-color: #bd081c; position: absolute; opacity: 1; z-index: 8675309; display: none; cursor: pointer; border: none; -webkit-font-smoothing: antialiased; top: 2026px; left: 50px; background-position: 3px 50%; background-repeat: no-repeat no-repeat;\">Save<\/span><\/p>\n<p><span style=\"border-top-left-radius: 2px; border-top-right-radius: 2px; border-bottom-right-radius: 2px; border-bottom-left-radius: 2px; text-indent: 20px; width: auto; padding: 0px 4px 0px 0px; text-align: center; font-style: normal; font-variant-caps: normal; font-weight: bold; font-stretch: normal; font-size: 11px; line-height: 20px; font-family: 'Helvetica Neue', Helvetica, sans-serif; color: #ffffff; background-image: url(data:image\/svg+xml; base64,phn2zyb4bwxucz0iahr0cdovl3d3dy53my5vcmcvmjawmc9zdmciighlawdodd0imzbwecigd2lkdgg9ijmwchgiihzpzxdcb3g9ii0xic0xidmxidmxij48zz48cgf0acbkpsjnmjkundq5lde0ljy2mibdmjkundq5ldiyljcymiaymi44njgsmjkumju2ide0ljc1ldi5lji1nibdni42mzismjkumju2idaumduxldiyljcymiawlja1mswxnc42njigqzaumduxldyunjaxidyunjmyldaumdy3ide0ljc1ldaumdy3iemymi44njgsmc4wnjcgmjkundq5ldyunjaxidi5ljq0oswxnc42njiiigzpbgw9iinmzmyiihn0cm9rzt0ii2zmziigc3ryb2tllxdpzhropsixij48l3bhdgg+phbhdgggzd0itte0ljczmywxljy4nibdny41mtysms42odygms42njusny40otugms42njusmtqunjyyiemxljy2nswymc4xntkgns4xmdksmjquodu0idkuotcsmjyunzq0iem5ljg1niwyns43mtggos43ntmsmjqumtqzidewljaxniwymy4wmjigqzewlji1mywymi4wmsaxms41ndgsmtyuntcyidexlju0ocwxni41nzigqzexlju0ocwxni41nzigmteumtu3lde1ljc5nsaxms4xntcsmtqunjq2iemxms4xntcsmtiuodqyideyljixmswxms40otugmtmuntiyldexljq5nsbdmtqunjm3ldexljq5nsaxns4xnzusmtiumzi2ide1lje3nswxmy4zmjmgqze1lje3nswxnc40mzygmtqundyylde2ljegmtqumdkzlde3ljy0mybdmtmunzg1lde4ljkznsaxnc43ndusmtkuotg4ide2ljayocwxos45odggqze4ljm1mswxos45odggmjaumtm2lde3lju1niaymc4xmzysmtqumdq2iemymc4xmzysmtauotm5ide3ljg4ocw4ljc2nyaxnc42nzgsoc43njcgqzewljk1osw4ljc2nya4ljc3nywxms41mzygoc43nzcsmtqumzk4iem4ljc3nywxns41mtmgos4ymswxni43mdkgos43ndksmtcumzu5iem5ljg1niwxny40odggos44nzismtcunia5ljg0lde3ljczmsbdos43ndesmtgumtqxidkuntismtkumdizidkundc3lde5ljiwmybdos40miwxos40nca5lji4ocwxos40otegos4wncwxos4znzygqzcunda4lde4ljyymia2ljm4nywxni4yntigni4zodcsmtqumzq5iem2ljm4nywxmc4yntygos4zodmsni40otcgmtuumdiyldyundk3iemxos41ntusni40otcgmjmumdc4ldkunza1idizlja3ocwxmy45otegqzizlja3ocwxoc40njmgmjaumjm5ldiylja2miaxni4yotcsmjiumdyyiemxnc45nzmsmjiumdyyidezljcyocwyms4znzkgmtmumzayldiwlju3mibdmtmumzayldiwlju3miaxmi42ndcsmjmumdugmtiundg4ldizljy1nybdmtiumtkzldi0ljc4ncaxms4zotysmjyumtk2idewljg2mywyny4wntggqzeylja4niwyny40mzqgmtmumzg2ldi3ljyznyaxnc43mzmsmjcunjm3iemyms45nswyny42mzcgmjcuodaxldixljgyocayny44mdesmtqunjyyiemyny44mdesny40otugmjeuotusms42odygmtqunzmzldeunjg2iibmawxspsijymqwodfjij48l3bhdgg+pc9npjwvc3znpg==); background-size: 14px 14px; background-color: #bd081c; position: absolute; opacity: 1; z-index: 8675309; display: none; cursor: pointer; border: none; -webkit-font-smoothing: antialiased; top: 1620px; left: 50px; background-position: 3px 50%; background-repeat: no-repeat no-repeat;\">Save<\/span><span style=\"border-top-left-radius: 2px; border-top-right-radius: 2px; border-bottom-right-radius: 2px; border-bottom-left-radius: 2px; text-indent: 20px; width: auto; padding: 0px 4px 0px 0px; text-align: center; font-style: normal; font-variant-caps: normal; font-weight: bold; font-stretch: normal; font-size: 11px; line-height: 20px; font-family: 'Helvetica Neue', Helvetica, sans-serif; color: #ffffff; background-image: url(data:image\/svg+xml; base64,phn2zyb4bwxucz0iahr0cdovl3d3dy53my5vcmcvmjawmc9zdmciighlawdodd0imzbwecigd2lkdgg9ijmwchgiihzpzxdcb3g9ii0xic0xidmxidmxij48zz48cgf0acbkpsjnmjkundq5lde0ljy2mibdmjkundq5ldiyljcymiaymi44njgsmjkumju2ide0ljc1ldi5lji1nibdni42mzismjkumju2idaumduxldiyljcymiawlja1mswxnc42njigqzaumduxldyunjaxidyunjmyldaumdy3ide0ljc1ldaumdy3iemymi44njgsmc4wnjcgmjkundq5ldyunjaxidi5ljq0oswxnc42njiiigzpbgw9iinmzmyiihn0cm9rzt0ii2zmziigc3ryb2tllxdpzhropsixij48l3bhdgg+phbhdgggzd0itte0ljczmywxljy4nibdny41mtysms42odygms42njusny40otugms42njusmtqunjyyiemxljy2nswymc4xntkgns4xmdksmjquodu0idkuotcsmjyunzq0iem5ljg1niwyns43mtggos43ntmsmjqumtqzidewljaxniwymy4wmjigqzewlji1mywymi4wmsaxms41ndgsmtyuntcyidexlju0ocwxni41nzigqzexlju0ocwxni41nzigmteumtu3lde1ljc5nsaxms4xntcsmtqunjq2iemxms4xntcsmtiuodqyideyljixmswxms40otugmtmuntiyldexljq5nsbdmtqunjm3ldexljq5nsaxns4xnzusmtiumzi2ide1lje3nswxmy4zmjmgqze1lje3nswxnc40mzygmtqundyylde2ljegmtqumdkzlde3ljy0mybdmtmunzg1lde4ljkznsaxnc43ndusmtkuotg4ide2ljayocwxos45odggqze4ljm1mswxos45odggmjaumtm2lde3lju1niaymc4xmzysmtqumdq2iemymc4xmzysmtauotm5ide3ljg4ocw4ljc2nyaxnc42nzgsoc43njcgqzewljk1osw4ljc2nya4ljc3nywxms41mzygoc43nzcsmtqumzk4iem4ljc3nywxns41mtmgos4ymswxni43mdkgos43ndksmtcumzu5iem5ljg1niwxny40odggos44nzismtcunia5ljg0lde3ljczmsbdos43ndesmtgumtqxidkuntismtkumdizidkundc3lde5ljiwmybdos40miwxos40nca5lji4ocwxos40otegos4wncwxos4znzygqzcunda4lde4ljyymia2ljm4nywxni4yntigni4zodcsmtqumzq5iem2ljm4nywxmc4yntygos4zodmsni40otcgmtuumdiyldyundk3iemxos41ntusni40otcgmjmumdc4ldkunza1idizlja3ocwxmy45otegqzizlja3ocwxoc40njmgmjaumjm5ldiylja2miaxni4yotcsmjiumdyyiemxnc45nzmsmjiumdyyidezljcyocwyms4znzkgmtmumzayldiwlju3mibdmtmumzayldiwlju3miaxmi42ndcsmjmumdugmtiundg4ldizljy1nybdmtiumtkzldi0ljc4ncaxms4zotysmjyumtk2idewljg2mywyny4wntggqzeylja4niwyny40mzqgmtmumzg2ldi3ljyznyaxnc43mzmsmjcunjm3iemyms45nswyny42mzcgmjcuodaxldixljgyocayny44mdesmtqunjyyiemyny44mdesny40otugmjeuotusms42odygmtqunzmzldeunjg2iibmawxspsijymqwodfjij48l3bhdgg+pc9npjwvc3znpg==); background-size: 14px 14px; background-color: #bd081c; position: absolute; opacity: 1; z-index: 8675309; display: none; cursor: pointer; border: none; -webkit-font-smoothing: antialiased; top: 1620px; left: 50px; background-position: 3px 50%; background-repeat: no-repeat no-repeat;\">Save<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Time does fly! It feels like only yesterday that a new strain of hitherto little-known malware achieved celebrity status among global ransomware campaigns. It\u2019s already been a year, almost to the day, since the WannaCryptor ransomware cryptoworm \u2013 also known as WannaCry and detected by ESET as&nbsp;Win32\/Filecoder.WannaCryptor.D&nbsp;\u2013 ran rampant. What made WannaCryptor\u2019s impact so severe,<\/p>\n","protected":false},"author":5,"featured_media":1849,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[147,150,168],"tags":[],"class_list":["post-447","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybercrime","category-encryption","category-ransomware"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.2 (Yoast SEO v27.4) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>12 months on, what are the lessons learned from WannaCryptor? - ESET Eesti Blogi<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"12 months on, what are the lessons learned from WannaCryptor?\" \/>\n<meta property=\"og:description\" content=\"Time does fly! It feels like only yesterday that a new strain of hitherto little-known malware achieved celebrity status among global ransomware campaigns. It\u2019s already been a year, almost to the day, since the WannaCryptor ransomware cryptoworm \u2013 also known as WannaCry and detected by ESET as&nbsp;Win32\/Filecoder.WannaCryptor.D&nbsp;\u2013 ran rampant. What made WannaCryptor\u2019s impact so severe,\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/\" \/>\n<meta property=\"og:site_name\" content=\"ESET Eesti Blogi\" \/>\n<meta property=\"article:publisher\" content=\"http:\/\/www.facebook.com\/antiviirus\" \/>\n<meta property=\"article:published_time\" content=\"2018-05-22T22:57:58+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-05-29T12:46:54+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blog.eset.ee\/wp-content\/uploads\/2019\/04\/WannaCry_1Year.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"667\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"ESET Blog\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ESET Blog\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2018\\\/05\\\/22\\\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2018\\\/05\\\/22\\\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\\\/\"},\"author\":{\"name\":\"ESET Blog\",\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/#\\\/schema\\\/person\\\/876cf293277fc0b2ae2f4395fffe4c88\"},\"headline\":\"12 months on, what are the lessons learned from WannaCryptor?\",\"datePublished\":\"2018-05-22T22:57:58+00:00\",\"dateModified\":\"2019-05-29T12:46:54+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2018\\\/05\\\/22\\\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\\\/\"},\"wordCount\":913,\"image\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2018\\\/05\\\/22\\\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/blog.eset.ee\\\/wp-content\\\/uploads\\\/2019\\\/04\\\/WannaCry_1Year.png\",\"articleSection\":[\"cybercrime\",\"encryption\",\"ransomware\"],\"inLanguage\":\"en-US\",\"copyrightYear\":\"2018\",\"copyrightHolder\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2018\\\/05\\\/22\\\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\\\/\",\"url\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2018\\\/05\\\/22\\\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\\\/\",\"name\":\"12 months on, what are the lessons learned from WannaCryptor? - ESET Eesti Blogi\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2018\\\/05\\\/22\\\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2018\\\/05\\\/22\\\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/blog.eset.ee\\\/wp-content\\\/uploads\\\/2019\\\/04\\\/WannaCry_1Year.png\",\"datePublished\":\"2018-05-22T22:57:58+00:00\",\"dateModified\":\"2019-05-29T12:46:54+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/#\\\/schema\\\/person\\\/876cf293277fc0b2ae2f4395fffe4c88\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2018\\\/05\\\/22\\\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2018\\\/05\\\/22\\\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2018\\\/05\\\/22\\\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\\\/#primaryimage\",\"url\":\"https:\\\/\\\/blog.eset.ee\\\/wp-content\\\/uploads\\\/2019\\\/04\\\/WannaCry_1Year.png\",\"contentUrl\":\"https:\\\/\\\/blog.eset.ee\\\/wp-content\\\/uploads\\\/2019\\\/04\\\/WannaCry_1Year.png\",\"width\":1000,\"height\":667},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2018\\\/05\\\/22\\\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"12 months on, what are the lessons learned from WannaCryptor?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/\",\"name\":\"ESET Eesti Blogi\",\"description\":\"Uudised IT maailmast\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/#\\\/schema\\\/person\\\/876cf293277fc0b2ae2f4395fffe4c88\",\"name\":\"ESET Blog\",\"sameAs\":[\"http:\\\/\\\/eset.ee\"],\"url\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/author\\\/allankinsigo\\\/\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/blog.eset.ee\\\/et\\\/en\\\/2018\\\/05\\\/22\\\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\\\/#local-main-organization-logo\",\"url\":\"\",\"contentUrl\":\"\",\"caption\":\"ESET EESTI\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"12 months on, what are the lessons learned from WannaCryptor? - ESET Eesti Blogi","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/","og_locale":"en_US","og_type":"article","og_title":"12 months on, what are the lessons learned from WannaCryptor?","og_description":"Time does fly! It feels like only yesterday that a new strain of hitherto little-known malware achieved celebrity status among global ransomware campaigns. It\u2019s already been a year, almost to the day, since the WannaCryptor ransomware cryptoworm \u2013 also known as WannaCry and detected by ESET as&nbsp;Win32\/Filecoder.WannaCryptor.D&nbsp;\u2013 ran rampant. What made WannaCryptor\u2019s impact so severe,","og_url":"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/","og_site_name":"ESET Eesti Blogi","article_publisher":"http:\/\/www.facebook.com\/antiviirus","article_published_time":"2018-05-22T22:57:58+00:00","article_modified_time":"2019-05-29T12:46:54+00:00","og_image":[{"width":1000,"height":667,"url":"https:\/\/blog.eset.ee\/wp-content\/uploads\/2019\/04\/WannaCry_1Year.png","type":"image\/png"}],"author":"ESET Blog","twitter_card":"summary_large_image","twitter_misc":{"Written by":"ESET Blog","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/#article","isPartOf":{"@id":"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/"},"author":{"name":"ESET Blog","@id":"https:\/\/blog.eset.ee\/et\/en\/#\/schema\/person\/876cf293277fc0b2ae2f4395fffe4c88"},"headline":"12 months on, what are the lessons learned from WannaCryptor?","datePublished":"2018-05-22T22:57:58+00:00","dateModified":"2019-05-29T12:46:54+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/"},"wordCount":913,"image":{"@id":"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.eset.ee\/wp-content\/uploads\/2019\/04\/WannaCry_1Year.png","articleSection":["cybercrime","encryption","ransomware"],"inLanguage":"en-US","copyrightYear":"2018","copyrightHolder":{"@id":"https:\/\/blog.eset.ee\/et\/#organization"}},{"@type":"WebPage","@id":"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/","url":"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/","name":"12 months on, what are the lessons learned from WannaCryptor? - ESET Eesti Blogi","isPartOf":{"@id":"https:\/\/blog.eset.ee\/et\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/#primaryimage"},"image":{"@id":"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.eset.ee\/wp-content\/uploads\/2019\/04\/WannaCry_1Year.png","datePublished":"2018-05-22T22:57:58+00:00","dateModified":"2019-05-29T12:46:54+00:00","author":{"@id":"https:\/\/blog.eset.ee\/et\/en\/#\/schema\/person\/876cf293277fc0b2ae2f4395fffe4c88"},"breadcrumb":{"@id":"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/#primaryimage","url":"https:\/\/blog.eset.ee\/wp-content\/uploads\/2019\/04\/WannaCry_1Year.png","contentUrl":"https:\/\/blog.eset.ee\/wp-content\/uploads\/2019\/04\/WannaCry_1Year.png","width":1000,"height":667},{"@type":"BreadcrumbList","@id":"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.eset.ee\/et\/en\/"},{"@type":"ListItem","position":2,"name":"12 months on, what are the lessons learned from WannaCryptor?"}]},{"@type":"WebSite","@id":"https:\/\/blog.eset.ee\/et\/en\/#website","url":"https:\/\/blog.eset.ee\/et\/en\/","name":"ESET Eesti Blogi","description":"Uudised IT maailmast","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.eset.ee\/et\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.eset.ee\/et\/en\/#\/schema\/person\/876cf293277fc0b2ae2f4395fffe4c88","name":"ESET Blog","sameAs":["http:\/\/eset.ee"],"url":"https:\/\/blog.eset.ee\/et\/en\/author\/allankinsigo\/"},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.eset.ee\/et\/en\/2018\/05\/22\/12-months-on-what-are-the-lessons-learned-from-wannacryptor\/#local-main-organization-logo","url":"","contentUrl":"","caption":"ESET EESTI"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/posts\/447","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/comments?post=447"}],"version-history":[{"count":0,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/posts\/447\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/media\/1849"}],"wp:attachment":[{"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/media?parent=447"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/categories?post=447"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.eset.ee\/et\/en\/wp-json\/wp\/v2\/tags?post=447"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}