WannaCry, NotPetya and the backup that saves you

On 14 March 2017 Microsoft released security update MS17-010 for flaws in Windows file sharing (SMB). A month later, on 14 April, a group calling itself the Shadow Brokers published a cache of hacking tools that included an exploit for those flaws, known as EternalBlue.

On Friday 12 May, WannaCry used it. The ransomware spread on its own from computer to computer, encrypting files and demanding payment in bitcoin. The UK government later put the toll at 300,000 computers in 150 countries. In England's National Health Service at least 81 of 236 hospital trusts and 595 GP practices were affected, and thousands of appointments were cancelled. It slowed only when a security researcher activated a kill switch built into the code. In December 2017 the UK attributed the attack to North Korean actors known as the Lazarus Group.

Six weeks later, on 27 June, NotPetya arrived through a poisoned update of M.E.Doc, accounting software widely used in Ukraine. It looked like ransomware, but CISA concluded that recovery was unlikely even for victims who paid. In February 2018 the White House blamed the Russian military and called it the most destructive and costly cyber-attack in history.