Malware Case Studies

WannaCry Ransomware Attack (2017) The WannaCry ransomware attack was one of the most devastating global cyberattacks, occurring in May 2017. This attack exploited a vulnerability in Microsoft Windows, known as EternalBlue, which had been previously discovered by the National Security Agency (NSA) but was leaked by the hacking group Shadow Brokers. WannaCry spread rapidly, encrypting files on infected computers and demanding ransom payments in Bitcoin for decryption keys. It impacted over 200,000 computers across 150 countries, severely affecting industries such as healthcare, telecommunications, and finance. The United Kingdom’s National Health Service (NHS) was among the hardest-hit organizations, leading to disruptions in medical services, canceled surgeries, and emergency patients being turned away. Although Microsoft had released a patch for the vulnerability prior to the attack, many organizations had not applied it, demonstrating the importance of timely security updates. A cybersecurity researcher, Marcus Hutchins, managed to halt the spread of the ransomware by registering a "kill switch" domain embedded in the malware's code. The WannaCry attack underscored the vulnerabilities in outdated software and the risks posed by cybercriminals leveraging government-discovered exploits.

Team member: Kampbell

NotPetya Malware Attack

The NotPetya malware attack, which began in June 2017, was initially believed to be ransomware but was later identified as a wiper malware designed to cause irreversible damage rather than to generate ransom payments. The attack primarily targeted Ukrainian businesses and government agencies, spreading through a compromised update to the widely used accounting software MeDoc. Like WannaCry, NotPetya exploited the EternalBlue vulnerability, enabling it to spread rapidly across networks. However, unlike traditional ransomware, it permanently encrypted files without any means of decryption, rendering affected systems unusable. The attack quickly spread beyond Ukraine, affecting multinational corporations such as Maersk, Merck, and FedEx, leading to billions of dollars in damages. The U.S. and U.K. governments attributed the attack to Russian state-sponsored hackers, citing geopolitical tensions between Russia and Ukraine. NotPetya highlighted the risks associated with supply-chain attacks, where a trusted software provider is compromised to distribute malware to its users. This incident reinforced the need for zero-trust security models, frequent backups, and robust network segmentation to prevent widespread infection.

Stuxnet Worm (2010)

The Stuxnet worm, discovered in 2010, is considered the first known cyber weapon designed to cause physical destruction in the real world. Developed in a covert operation reportedly led by the United States and Israel, Stuxnet targeted Iran’s nuclear program, specifically the Natanz uranium enrichment facility. Unlike traditional malware, Stuxnet was engineered to attack supervisory control and data acquisition (SCADA) systems—industrial control systems used to operate machinery. It exploited multiple zero-day vulnerabilities in Microsoft Windows and spread via USB drives, making it highly effective in infiltrating air-gapped systems. Once inside, it manipulated the speeds of nuclear centrifuges, causing them to spin at unsafe speeds while displaying normal readings to operators, resulting in physical damage to Iran’s nuclear program. The worm's discovery shocked the cybersecurity world, as it demonstrated the potential for malware to be used as a military-grade cyberweapon. Stuxnet’s impact extended beyond Iran, influencing the development of cyber warfare strategies worldwide and raising ethical concerns about the use of offensive cybersecurity measures in global conflicts