ALT-39 · Analysis · 23 Oct 2026
WannaCry: a leaked exploit, a worm, and a kill switch
Two months after a patch was published, a ransomware worm used a leaked NSA exploit to hit hundreds of thousands of computers — including a third of England's NHS trusts — until a registered domain stopped it.
- 14 Mar 2017Microsoft publishes MS17-010.
- 14 Apr 2017The Shadow Brokers leak EternalBlue.
- 12 May 2017WannaCry spreads globally; the kill-switch domain is registered that afternoon.
- Dec 2017The US and UK attribute the attack to North Korea.
- NHS trusts in England disrupted, of 236
- 81UK National Audit Office (2017)
- NHS appointments estimated cancelled
- ~19,000UK National Audit Office (2017)
Why it spread so fast
It needed no user to click anything: any reachable machine with SMBv1 and without the March patch could be infected. NHS Digital told the NAO that every infected organisation had unpatched or unsupported Windows systems, and the NAO concluded the attack could have been prevented by basic IT security practice.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Patch speed is a security control, measured in days.
- Exploits stockpiled by governments do not stay stockpiled.
- A kill switch was luck; resilience cannot depend on it.
What to do
- Disable SMBv1 and block file sharing ports at the network edge.
- Measure time-to-patch for critical vulnerabilities and report it.
- Know which systems cannot be patched and isolate them.
Sources
- National Audit Office — Investigation: WannaCry cyber attack and the NHS
- Microsoft — Security Bulletin MS17-010
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-39 — WannaCry: a leaked exploit, a worm, and a kill switch. 23 Oct 2026. altumptic.com/research/wannacry-2017