WannaCry is back! (Psych. It’s just phisher folk doing what they do)

June 22, 2018 TH Author

An unusually large wave of phishing emails was spewed out this morning, with recipients warned that all their devices had been infected by WannaCry.

Action Fraud UK has said it has already received over 200 reports of the phishy email this morning, while beleaguered IT support contractors – seemingly mostly based in the UK – were asking users to delete, refrain from clicking links and carry on with their lives. Still others were, um, urging clients to install extra security software…

Presumably the tsunami of spam was in celebration of the Summer Solstice. Or more likely because the authors are horrible human beings.

We are receiving reports this morning of a #wannacry threat email being widely received.

It is designed to cause panic resulting in payment of their empty threat.

If you have concerns speak with your IT company.

Finally – use this as an opportunity to review your backups! pic.twitter.com/GQSOCmwdk1

— Pro-Networks (@pronetworksuk) June 21, 2018

The email warns of a super virus, able to run on any platform (Windows, iOS, Linux, and so on), which cannot be detected by antivirus and renders firewalls, erm, “marrowless” in some versions of the email we’ve seen.

Furthermore, users’ data will be deleted by the miracle cross-platform software between 17:00 and 22:00 on 22 June 2018 unless 0.1 BTC (around $650, according to the scammers) is coughed up.

It is, of course, utter nonsense and plays on the fears of users following last year’s WannaCry fiasco.

WannaCry worked by spreading over networks by exploiting a flaw in the ancient SMB 1 networking protocol and encrypting files. Users (including institutions such as the UK’s National Health Service) had to pay a ransom to get their files back or face a loss of data.

By the end of July last year, the ransom wallet stood at 52.19666422 BTC (around $145,000 back then) before the scammers began withdrawals.

Phishing attacks soon followed, with users worried by some very realistic emails pretending to be from BT.

The authors of today’s less sophisticated scam attempt have been somewhat less successful, with the balance of their wallet standing at precisely zero at time of writing.

Recipients of the email should treat it with the contempt it deserves and delete it. It goes without saying that following any links it contains or opening any attachments is an absolute no-no.

It would also be a good idea to ensure security patches are up to date and backups are being checked, because it is unlikely to be long before another worm is menacing networks for real.

Thanks to reader Nathan Lock for tipping us off. ®

Sponsored: Minds Mastering Machines – Call for papers now open