WannaCry is ransomware that, once it appeared in public, spread on its own to vulnerable machines.
It encrypted data and demanded a payment for a claimed decryption.
Spread used a flaw in a widely deployed file service, not the cooperation of each victim.
Origins of WannaCry
The malicious code became known after attack tools that had not been public reached the public.
Organizations that had not updated the affected service were reachable.
The origin is the combination of leaked knowledge and missing maintenance.
The Shadow Brokers
The Shadow Brokers published material from a stock of stolen attack tools.
Among it was the basis WannaCry later used to reach machines over the network.
Publication made a previously limited path usable by arbitrary attackers.
How WannaCry Works
WannaCry looked for reachable systems with the affected file service, established itself there, and encrypted files.
It also displayed a demand for payment.
Further spread continued from newly infected systems as long as the unpatched service stayed reachable.
EternalBlue Exploit
The EternalBlue exploit used a flaw in the Windows file-sharing service to cause code to run on an unpatched system.
WannaCry used that path to spread without action by users.
Systems that had received the provided update were no longer reachable by this path.
Impact of WannaCry
The effect hit organizations whose many machines exposed the same unpatched service to the network.
Operations stopped where encrypted data and failed devices blocked immediate work.
Payment was not a reliable route to recovery, and backups were.
Case Study: NHS
At the NHS, the infection caused care systems to fail and appointments not to run as planned.
Clinical work had to fall back to emergency operation and to paths that did not use the affected systems.
The case shows how a missing update of an ordinary service can hit an entire care operation.
Preventing WannaCry and Similar Attacks
Prevention of WannaCry and similar worms is timely installation of updates for exposed services and separation of services that do not belong on the network.
Backups that the worm cannot encrypt as well keep recovery independent of a payment.
A web firewall or a mail filter does not replace closing that propagation service.
Cybersecurity Awareness
Cybersecurity awareness explains why updates for internal services rank with caution about attachments.
It also addresses operators who approve maintenance windows, not only recipients of email.
People who understand that an exposed file service carries the worm prioritize the update differently.
Conclusion
WannaCry joined a leaked exploit with automatic spread and encryption.
The damage followed from reachable systems that had not been updated.
Updates, separated services, and usable backups remain the direct answer to this kind of worm.