WannaCry Ransomware: 8 Myths vs Facts From the 2017 Attack

Did WannaCry ransomware really get in through a bad email attachment? It is one of the first things students ask when we cover May 2017, and the short reply is mostly no. WannaCry ransomware moved by itself from computer to computer through a Windows file-sharing flaw that Microsoft had already fixed in March 2017.

That one detail changes how you should read the whole event. Here is what this case study covers:

• What actually happened on 12 May 2017, with a timeline in Pakistan time
• How the worm spread, explained in plain language for defenders
• Eight popular myths, each checked against official reports
• The damage to Britain's health service, who was blamed and how firm that blame is
• Seven defensive lessons for offices, hospitals and banks in Pakistan

What Was the WannaCry Attack?

The WannaCry attack was a ransomware outbreak that began on Friday, 12 May 2017. It locked files on Windows computers and showed a note asking for payment in Bitcoin. The US cyber agency CISA put the demand at about $300 per machine in its alert TA17-132A.

What made it different from earlier ransomware was speed. Most ransomware needs a person to open something. WannaCry ransomware behaved like a worm: once it was on one machine, it searched for other vulnerable machines and copied itself to them without anyone clicking.

The scale is still debated. The UK government said in a December 2017 statement that about 300,000 computers in 150 countries were hit. The US Justice Department later described "hundreds of thousands" of infected computers in more than 150 countries. Both figures are estimates, because many victims never reported anything.

The best-documented victim of WannaCry ransomware is England's National Health Service (NHS). Britain's public spending watchdog, the National Audit Office (NAO), published a full investigation of the NHS cyber attack in October 2017. Much of what we know for certain comes from that report.

WannaCry Ransomware Timeline in Pakistan Time

The table below lists the key dates. Times are given in Pakistan Standard Time (PKT) where a source gives a clock time.

Notice the gap between the first and third rows. The patch existed for roughly two months before the outbreak. That gap is the heart of this story.

How Did the EternalBlue Exploit Let It Spread?

Windows uses a protocol called SMB (Server Message Block) to share files and printers on a network. The oldest version, SMBv1, had a serious flaw. According to CISA, WannaCry ransomware used the EternalBlue exploit against that flaw to run its own code on machines that had not installed the MS17-010 patch. EternalBlue had become public in mid-April 2017, when the Shadow Brokers group leaked a batch of hacking tools. SecurityWeek reported that Microsoft said its March updates already covered that exploit.

At a conceptual level, the spread worked in five stages:

1. A first foothold. The malware reached one computer. CISA notes that some open-source reports suggested phishing, but that was never the main engine.
2. A check-in. Before doing damage, the program tried to reach a web address. If the address answered, it stopped. This is the "kill switch".
3. A search for neighbors. It scanned nearby network addresses for machines with file-sharing ports open, mainly TCP port 445.
4. A copy. On any unpatched machine it found, it used the SMBv1 flaw to install itself.
5. A lock. It encrypted files and showed the ransom note, while each new copy kept searching.

Stage three is why one infected laptop could take down a whole hospital floor. Flat networks, where every PC can talk to every other PC, gave the worm a clear path. If you want to see what that kind of traffic looks like, our Wireshark guide for beginners shows how to read SMB and other protocols in a safe lab.

Eight Myths, Checked Against the Record

WannaCry ransomware is now nearly a decade old, and the retelling has drifted. Here are the eight claims we hear most often in class, set against what the official sources say.

Myth 1: It Spread Through Phishing Emails

The fast spread came from the worm, not from inboxes. CISA's alert describes scanning and SMB exploitation as the propagation method. Phishing appears only as a possible starting point that some outside reports suggested.

Myth 2: There Was No Fix When It Struck

There was. Microsoft's security response blog confirms the MS17-010 patch was released in March 2017. The NAO adds that NHS Digital sent critical patching alerts to health bodies in March and April.

Myth 3: Only Ancient Windows XP Machines Were Hit

Old systems were part of the problem, but not all of it. The NAO says infected organizations had "unpatched or unsupported" Windows systems. A supported computer that skipped its updates was just as exposed. Microsoft did take the unusual step of offering the fix for Windows XP on 13 May, because XP no longer received regular updates.

Myth 4: The NHS Paid the Ransom to Get Back Online

According to the NAO, the Department of Health, NHS England and the National Crime Agency all said no NHS organization paid. Recovery came from IT teams rebuilding and restoring systems.

Myth 5: Patient Records Were Stolen

NHS Digital told the NAO it believed no patient data was compromised or stolen. WannaCry ransomware locked files where they sat. That is a useful reminder that ransomware damage is often about lost access, not leaked data, although many later ransomware groups do both.

Myth 6: It Was a Highly Advanced Operation

The head of the NAO, Amyas Morse, called it "a relatively unsophisticated attack". The NAO found that basic IT hygiene, such as patching and managing firewalls, would have protected most of the NHS.

Myth 7: The Kill Switch Ended the Threat for Good

The kill switch slowed new infections, but it did not clean infected machines. The NAO reports that 92 more NHS organizations, including 21 trusts, contacted the WannaCry domain between 15 May and mid-September 2017. CISA even advised network teams not to block the kill-switch address, because blocking it could let the malware run.

Myth 8: Pakistan Was Not Affected

Pakistan was not on the early lists of hit countries. On 19 May 2017, though, Daily Pakistan reported, citing ARY News, that the state-owned State Life Insurance had been hit and staff were told not to switch on their computers without technical help. We found no official public report on how many Pakistani machines were affected.

Counting the Damage: Computers, Hospitals and Money

The NHS figures are the clearest record of what a worm can do to a public service. The NAO found that at least 81 of England's 236 hospital trusts were affected, about 34%. Of those, 37 trusts were actually infected and the rest were disrupted because they shared systems or switched off links as a precaution. A further 603 primary care and other NHS organizations were infected, including 595 GP practices.

For patients, NHS England recorded 6,912 canceled appointments in the first week and estimated the true total at over 19,000. Five accident and emergency departments diverted patients elsewhere.

Here the sources disagree, and it is worth saying why. The UK government statement mentions 48 NHS trusts, while the NAO counts 37 infected and 81 affected. The likely reason is different counting rules: infected, disrupted and "affected" are not the same thing. When you report an incident, define your terms before you quote a number.

Money is another moving figure. In October 2017 the NAO said the Department of Health did not know what the attack had cost. A year later, the department's own estimate, reported by Digital Health, put the cost at £92 million: about £19 million in lost output and £73 million in IT recovery work. Compare that with a ransom of about $300 per machine. The ransom was never the expensive part.

Who Was Blamed, and How Confident Is That Attribution?

Three governments' findings point the same way, but they use different levels of certainty.

The Justice Department said investigators linked the attacks through shared infrastructure, reused code, connected email and social media accounts, and similar malware design. The same complaint also covers the 2014 Sony Pictures hack and the theft we covered in our Bangladesh Bank heist case study.

Two cautions apply. First, a charge is an allegation, and the Justice Department itself notes that the defendant is presumed innocent. Its release does not say he is in custody. Second, the evidence behind intelligence assessments is mostly not public, so outside researchers cannot fully check it. What you can say with confidence is that the US and UK governments formally blamed North Korea.

What Happened Afterwards

The response unfolded in three directions.

Fixes. Microsoft's unusual XP patch on 13 May showed how seriously the company treated the outbreak. CISA's alert urged teams to disable SMBv1 and block SMB traffic at network boundaries, advice that still applies today.

Accountability. The NAO found that the Department of Health had been warned about cyber risks a year earlier but had no formal way to check whether hospitals followed its guidance. Its national response plan had not been tested locally, and email outages slowed communication on the day.

Prosecution and sanctions. Alongside the 2018 charges, the US Treasury sanctioned Park Jin Hyok and his employer, according to the Justice Department. No one has stood trial for the WannaCry ransomware campaign.

The group blamed for WannaCry ransomware shows up again in later thefts. Our posts on the Bybit hack and the Binance hack trace how North Korea-linked teams moved from locking files to stealing cryptocurrency directly.

What Did WannaCry Ransomware Mean for Pakistan?

The State Life Insurance report shows that Pakistani institutions were within reach. The deeper lesson is about how many local offices still run Windows.

Ask yourself a few questions about the computers you use at work. Does every PC receive Windows updates, or are some left alone because an old billing or lab program "only works on this machine"? Is there a computer still running Windows 7, which Microsoft no longer supports? Can every PC on the network reach every other PC?

Hospitals, banks, schools and government departments in Pakistan face the same conditions the NHS did: busy staff, old equipment that supports critical work, and patching that gets postponed. The NAO's most useful finding applies directly here. Organizations that managed their firewalls and installed patches were protected, whatever their size.

For individuals, the takeaway is simpler. Turn on automatic updates, keep an offline backup of important files, and never pay a ransom expecting a guaranteed result. If you think a device is already compromised, our guide to checking a phone for signs of hacking covers the first steps.

Seven Defensive Lessons From the WannaCry Attack

These are the lessons we ask students to defend in their own words. Each one ties back to a finding above.

1. Patch critical flaws in days, not months. The MS17-010 patch was out for about eight weeks before the outbreak. Track critical patches separately from routine ones.
2. Turn off SMBv1. Modern Windows does not need it. Where an old device depends on it, isolate that device.
3. Block SMB at the network edge. CISA recommended blocking port 445 and related ports at network boundaries. File sharing should never face the open internet.
4. Segment the network. Separate clinical, finance and guest machines so a worm cannot jump freely between them.
5. Keep offline backups and test them. A backup you have never restored is a hope, not a plan. Good ransomware protection depends on a copy the malware cannot reach.
6. Rehearse your incident plan. The NHS had a plan that had not been tested locally. Run a tabletop drill at least once a year, including what to do when email is down.
7. Know your old systems. Keep a written list of every unsupported operating system, why it exists and what protects it.

Practicing Patch and Recovery Drills at PSTA

Reading about WannaCry ransomware is useful. Rebuilding its logic in a safe lab is where the lessons stick. In PSTA's Cyber Security & Ethical Hacking course, you work through real case studies like this one over 12 weeks. The course is set at beginner level, so you do not need prior security experience.

The syllabus begins with confidentiality, integrity, availability and risk. From there it moves to attack types, beginner ethical hacking, defending a network, spotting malware, digital forensics and cyber law. In the labs you set up an isolated practice environment, run vulnerability scans, configure firewalls and intrusion detection, and investigate an incident while documenting its timeline. You can join classes online from anywhere in Pakistan or attend in person at our Abbottabad campus on Old College Road, Mandian.

If you already know the basics and want to study malware behavior in a sandbox, our Advanced Ethical Hacking & Penetration Testing course runs for three months and includes a malware analysis module. Before either course, you can prepare with our walkthrough on building an ethical hacking lab at home and our overview of cyber security certifications for beginners. To ask about batch dates, message our admissions team on WhatsApp from the course page.

Check One Office PC for SMBv1 This Week

Pick one Windows computer you are responsible for, at home or at work. Confirm that Windows Update shows no pending security updates, and ask your IT person whether SMBv1 is turned off on it. If the answer is "we are not sure", you have found your first security task, and you have just applied the main lesson of the WannaCry ransomware outbreak.