Date: 15 May 2017
The purpose of this alert is to bring attention to, and to provide guidance and mitigation advice for a large scale ransomware campaign.
CCIRC is aware of a large scale ransomware campaign known as “WCry”, “Wana”, “WCrypt”, “wannacrypt”, “WanaDecryptor” or “WanaCry” that has affected numerous organizations worldwide. CCIRC continues to work with domestic and international partners to assess the impact to Canada and to provide mitigation guidance and advice.
Ransomware can have an overwhelming on individuals, businesses, critical infrastructure and government. Not only can it lead to the loss of access to sensitive or proprietary information, but the disruption to regular operations, the financial loss and the potential harm to an organization’s reputation can be devastating.
The WannaCry ransomware campaign appears to be using the vulnerability addressed by Microsoft Security Bulletin MS17-010 to propagate through the network using the SMBv1 protocol. This enables the malware to infect additional devices connected to the same network if they are unpatched.
CCIRC strongly discourages paying the ransom as it does not guarantee that your data will be decrypted. In addition, decrypting files does not mean the malware infection itself has been removed.
CCIRC recommends that organizations review the following mitigation information and consider their implementation in the context of their network environment. Furthermore, indicators of compromise, including a yara signature, and analysis are available from US-CERT (available in reference).
Advice specific to propagation via SMBv1:
- Apply the Microsoft patch for the MS17-010 SMB vulnerability dated March 14, 2017.
- A new patch has been made available for some Microsoft legacy platforms, and is available here:
- If it is not possible to apply the patches, consider disabling SMBv1 and/or block SMBv1 ports on network devices [UDP 137, 138 and TCP 139, 445]. Guidance available here: https://support.microsoft.com/en-us/help/2696547
- To prevent inbound Internet connections by infected hosts, block SMBv1 ports at your network perimeter.
- To prevent your own infected hosts from infecting other external networks, block outbound SMBv1 connections at your network perimeter.
- Execute daily backups of all critical systems, maintain offline and offsite copies of backup media and periodically execute a practice data restoration from backups, including key databases to ensure integrity of existing backups and processes.
- NCSC UK has shared DNS based mitigation advice concerning WannaCry in a post titled “Ransomware: Latest NCSC Guidance”. (See link provided below)
- Ensure antivirus and gateway protections are up to date.
General advice to mitigate common email infection vectors:
- Scan all incoming and outgoing e-mails to detect threats and prevent executable files from reaching the end users.
- Don’t open links or attachments in emails from untrusted or unknown sources. Inspect the sender address carefully as the address text may differ from the real address.
- Most often, attacks of this type are detected by diligent and well-informed users. CCIRC recommends that organizations ensure users receive current situational awareness and training, including instructions on how to report unusual or suspicious emails to their IT Security Branch. Reviewing departmental policies, requirements and security education and awareness training can help reduce this threat.
- CCIRC Advisory AV17-068 Microsoft Security Updates MS17-010 - (SMBv1)
- CCIRC AV17-032 Microsoft Critical Security Bulletins Summary – March 2017
- Ransomware: Latest NCSC Guidance
- Latest statement on international ransomware cyber attack
- Alert (TA17-132A) Indicators Associated With WannaCry Ransomware
- Customer Guidance for WannaCrypt attacks
- Microsoft Security Bulletin MS17-010 - Critical
- CCIRC IN13-004 Ransomware
- CCIRC TR11-001 Malware Infection Recovery Guide