The infamous ransomware known as WannaCry has infected a quarter of a million computers worldwide, and the total of headlines about it probably makes authors of Locky and Cerber feel disappointed. There is no doubt that the critical ransomware that used EternalBlue exploit to attack computer systems has attracted much media attention. Quick reaction from malware researchers helped to find a kill-switch to inactivate the virus, however, today security experts warn to beware of WannaCry 2.0 that has no kill-switch. However, recently malware analysts have come up with some very suspicious technical details about this virus, raising suspicions that North Korea could be the one to blame for the attack.
The dramatic discovery was made by a Google security researcher Neel Mehta. Researcher claims that some lines of WannaCry’s source code match code of the malicious software called “Contopee” that was used by a North Korean hacker group known as “Lazarus.” The group was accused of hacking Sony Pictures back in 2014 and also stealing six-figure sum from Bangladesh bank in 2016. However, it is only a small observation, which does not prove anything yet. It is a well-known fact that developers of legitimate or malicious programs copy pieces of code of software that is already available. According to security researcher Matt Suiche, “if validated, this means the latest iteration of WannaCry would, in fact, be the first nation state powered ransomware.” At the moment, it is too early to form any conclusions, and apparently, further analysis is required. It is natural that people are looking for culprits of such massive cyber attack, but at the moment, computer users should focus on methods to protect their computers. eSolutions team highly recommends these tips on how to survive the WannaCrypt attack.