Back to Basics: Worm Defense in the Ransomware Age
Summary: Cisco Talos recounts that Microsoft released MS17-010 in March 2017 for an SMBv1 remote code execution flaw, exploits for which TheShadowBrokers published the following month, and that WannaCry in May 2017 and Nyetya in June 2017 both used it to spread. WannaCry spread via a buggy internet-wide SMBv1 scan and was stopped by a single-domain killswitch, while Nyetya delivered backdoored software updates through a compromised update server used in Ukraine and propagated internally using PSExec, WMI and stolen credentials.
Key Takeaway: Installing the MS17-010 update would have prevented a WannaCry infection outright, yet both worms caused global disruption because patching was skipped - and Nyetya showed a trusted software update server can be the entry point for a worm that wipes hard drives with no reversal mechanism.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026