Ransomware and its variants have become a serious threat around the world, and 2017 saw new, more virulent and destructive variants with a variety of purposes. The two most discussed and largest ransomware attacks in history— WannaCry and NotPetya—hit during 2017 and were the most prolific ever seen. Together, they infected more than 200,000 machines in more than 100 countries, all within just 24 hours. These attacks used the EternalBlue exploit to attack the server message block (SMB), which is essentially a filesharing vulnerability on Windows XP and newer. The malware was then able to move laterally through the network just like a worm, reaching any computer running SMB, even those not connected directly to the network, but to another networkconnected device.

 

NotPetya arrived a few months later, using the same exploit to eventually spread worldwide from its origin as an infected update to Ukrainian tax software. Rather than encrypting files, NotPetya modified the master boot record (MBR) and encrypted the entire hard drive, preventing the Windows OS from booting. The attack was designed to do as much damage as possible to Ukrainian infrastructure during a holiday, and it achieved its goal: power plants, banks, and supermarkets were shut down. After the attack spread across the world, estimated damages of more than $1.2 billion were reported.