Well, guess what? Not everyone has patched even now, more than two years later, and WannaCry is not only still alive (and ignoring the kill switch that was designed to stop it), but possibly
more alive than ever.
Fortunately, although we’re still seeing huge amounts of WannaCry activity, we aren’t seeing many people actually getting their data scrambled by it. And because people who are
infected aren’t themselves visibly being
affected by unwanted encryption and ransom demands, they don’t realise they’re being using to spread copies of it. But how on earth can a destructive virus more than two years old, one that was patched against even before it first appeared, continue to spread like crazy? And how come it’s still alive but no longer drawing attention to itself by leaving a sea of scrambled files and ransom demands in its wake? More importantly, what can we do to stop it now? The data that our experts analyse in their report is fascinating :
- More than 12,000 WannaCry variants were found in the wild, two years after the malware was supposedly conquered for good.
- More than 5,000,000 attempted attacks against unpatched computers were blocked in the last three months of 2018 – and that’s just the ones where Sophos Endpoint Security was installed and reported back to us.
- More than 97% of unpatched computers under attack were runnning Windows 7, so this is not just a story about forgotten Windows XP devices.
- A few people actually paid the ransom even though there’s no point in doing so. The crooks behind the relevant Bitcoin addresses aren’t monitoring payments or providing decryption tools.
