When your own cyber weapons are used against your own country, there is a duty to protect and defend, and responsible disclosure is now the only way forward.” We would say that this goes beyond just a moral obligation. “At this point, the NSA and CIA have a moral obligation to responsibly disclose all additional vulnerabilities. Furthermore, many of these are probably already out ‘in the wild’ and available to cybercriminals,” Andy Yen, co-founder of ProtonMail, pointed out. If we have learned anything from the NSA hack, and the more recent CIA Vault7 leaks, it’s that potentially hundreds of additional exploits exist, many targeting other platforms, not just Microsoft Windows. “Friday’s attack is a clear demonstration of the damage that just a SINGLE exploit can do. Microsoft has blamed users for not implementing updates, but also the NSA and governments in general for stockpiling software vulnerabilities instead of reporting them so that they can get fixed. The only thing that we know for sure is that the attack has made seemingly everybody search for someone else to blame. This fact that has been exploited by scammers, who were spotted offering fake decryptor tools to the victims. more victims decide not to pay the ransom).īy the way, there is currently no available decryption tool for WannaCry victims. The theory goes like this: Make the attack so big that everybody and their mother hears about it, make it known that the criminals are not giving up decryption keys even if they get paid, and see doubt work its magic on other ransomware operations (i.e. But, of course, that could also be a simple error by the authors or, as security researcher Marcus Hutchins (aka MalwareTech) has pointed out, an anti-sandbox check.Īs reports began trickling in about victims paying the ransom and not receiving a decryption key, another theory was floated online, half in earnest, half in jest: the WannaCry attack was an attempt, by persons unknown, to kill-off the burgeoning ransomware business model. In fact, it could be just a clue left intentionally to throw investigators off the right track.Īnother clue that points more in the direction of state-sponsored hackers instead of plain cyber criminals is the fact that the malware sported a so-called kill-switch – a way to stop the infection. Other researchers have confirmed that particular finding, but it is not nearly enough to conclusively tie the WannaCry attack to the group. It is believed that the group is behind the 2014 Sony Entertainment attack and the 2016 compromise of Bangladesh’s central bank, and is of North Korean origin. Keen-eyed Google researcher Neel Mehta noticed a similarity of some of WannaCry’s code to that used in a piece of malware associated with Lazarus, a hacking group that has been targeting institutions and businesses in the US and South Korea. The risk tied to the withdrawal of the money has escalated with each passing day.īut could it be that the money was never the primary goal? A connection to state-sponsored hackers The attack has, by accident or on purpose, attracted the attention of the public, security researchers, law enforcement and intelligence agencies. Will the criminals ever try to retrieve it, and risk being unmasked? That depends on who they are, and how much money are they willing to leave on the table. around $67,000 – remains where it has been delivered by the victims. The money – currently some 40 bitcoin, i.e. As the amount of money in the three bitcoin addresses associated with the WannaCry attack slowly continues to rise, the question of who is behind the ransomware is still without answer.

Lazarus group wannacry neel meheta