WannaCry Remains No. 1 Ransomware Weapon

Of all of the ransomware variants spotted targeting victims in the first half of 2019, the infamous WannaCry was by far the most prevalent, according to Trend Micros detection data.

More than two years after the historic WannaCry ransomware campaign rocked the world, rapidly locking down data on more than 200,000 Windows machines in 150 countries, the known and preventable variant remains by far the most commonly detected ransomware: About 10 times as many machines were found targeted by WannaCry in the first half of this year than all other ransomware variants combined.
WannaCry exploits an old SMB vulnerability that Microsoft patched in 2017, so the machines where WannaCry attacks were detected are mostly outdated Windows 7 systems – some 95% of them, according to attack attempts detected and stopped by Trend Micros Smart Protection Network.
The crooks running ransomware schemes are using a reliable tool – WannaCry – for their crimes. Theres no innovation or deep thought. Its just a way for them to steal, says Bill Malik, vice president of infrastructure strategies at Trend Micro, whose midyear security report, published today, includes the ransomware data.
These machines are mostly enterprise Windows machines in manufacturing, government, education, and healthcare, not consumer devices, Trend Micros telemetry shows. Those machines, deployed years ago, are mission-critical in those industries, so the victims are willing to pay to have their systems and data back, Malik notes.
The security firm also found WannaCry targeting machines in finance, technology, energy, food and beverage, and oil and gas organizations.
At the same time, the number of overall ransomware variants dropped dramatically in the first half of 2019, according to
Trend Micros report
, A total of 118 new ransomware families emerged in the first half of 2018, but only 47 new ones debuted in the first six months of this year. Thats because attackers have learned its all about quality, not quantity. They have moved from casting a wide net to targeting victim organizations more likely to pay up, which is making them more money overall.
Variants within a family give additional potency to those attack [new] vectors, Trend Micros Malik says.
Ransomware attacks have become an epidemic among municipalities over the past year – most recently the attack campaign that hit 23 localities in Texas this month. These small government entities are a prime target for obvious reasons.
Cities have critical systems and not a lot of money for skilled information security people, so they are running thin. Attackers realize that a city cannot simply stop operations, so in many cases they have no choice but to pay, Malik says. Note that this comes at a painful local cost. The money isnt sitting in a bank account; it is funding that would otherwise go to libraries, after-school programs, road repair, emergency services, and other basic needs.
Overall, Trend Micro spotted a 77% increase in ransomware attack attempts via malicious files, emails, and URLs. Ryuk ransomware was among the hottest and most prolific newer variants going after machines from January through June. Ryuk also tallied the largest ransomware payout of the year, when Riviera Beach, Florida, was infected with Ryuk and paid the $600,000 in ransom to the attackers, followed by Lake City, Florida, which shelled out $460,000 in ransom.
We recognize that the number of older, unpatched, installed systems will remain a target for attackers, whether running ransomware, cryptocurrency mining, botnets, credential harvesting, or other forms of malware, Trends Malik says.
And those older systems dont appear to be going anywhere fast. Some 48% of small to midsize businesses still run heavily on Windows XP or Windows 7, according to new research from Kaspersky Lab, which found that 41% of consumers run these shuttered or nearing end-of-life operating systems. The security firms anonymized telemetry data shows that 47% of SMBs run Windows 7, as do 38% of consumers and very small businesses. Windows 7 will no longer be supported by Microsoft as of January 2020.
Related Content:
8 Head-Turning Ransomware Attacks to Hit City Governments
Ransomware Shifts Focus from Consumers to Businesses
Malware Researcher Hutchins Sentenced to Supervised Release
To Pay or Not To Pay? That Is the (Ransomware) Question
Check out
The Edge
, Dark Readings new section for features, threat data, and in-depth perspectives. Todays top story:
Culture Eats Policy for Breakfast: Rethinking Security Awareness Training
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
WannaCry Remains No. 1 Ransomware Weapon