{"id":60263,"date":"2025-09-26T11:02:44","date_gmt":"2025-09-26T11:02:44","guid":{"rendered":"https:\/\/becolve.com\/blog\/recommendations-and-best-practices-for-ransomware-wannacry\/"},"modified":"2025-09-26T11:02:44","modified_gmt":"2025-09-26T11:02:44","slug":"recommendations-and-best-practices-for-ransomware-wannacry","status":"publish","type":"blog","link":"https:\/\/becolve.com\/en\/blog\/recommendations-and-best-practices-for-ransomware-wannacry\/","title":{"rendered":"Recommendations and Best Practices for Ransomware WannaCry"},"content":{"rendered":"

The massive attack<\/strong> last Friday, May 12<\/strong>, is now globally known. A ransomware known as WannaCry\/WannaCrypt0r<\/strong> has spread worldwide, exploiting a vulnerability published by Microsoft on March 14, 2017<\/strong>, described in the bulletin as MS17-010<\/strong> and known as \u201cEternalBlue.\u201d<\/strong> <\/p>\n

How has it spread? <\/strong>
\nWannaCry acts similarly to a worm, meaning it tries to spread through the network. To do this, it exploits an SMB vulnerability \u201cEternalBlue\u201d (with CVE-2017-0145) that affects messages from version 1 of SMB (SMBv1). It scans both the internal and external network, making connections on port 445 in search of unupdated computers. <\/p>\n

What are the causes of its infection? <\/strong>
\nWhen the malicious code has been executed on the infected PC, WannaCry checks if a specific domain exists on the Internet; if it does, it ends its execution. If it does not exist, it begins its task by creating system services, entries in the Windows registry, several threads for different tasks, and finally encrypts all the files found that meet an extension pattern in all the units it finds in the infected system. Meanwhile, it proceeds to infect new machines as explained in the previous point. <\/p>\n

Is it still spreading?<\/strong>
\nAt the moment, its spread has been partially stopped, since the domain to which WannaCry makes requests has been registered, thanks to a cybersecurity researcher, who was the one who registered this domain.<\/p>\n

\n

I will confess that I was unaware registering the domain would stop the malware until after i registered it, so initially it was accidental.<\/p>\n

\u2014 MalwareTech (@MalwareTechBlog) May 13, 2017<\/a><\/p><\/blockquote>\n

However, it is important to be prepared, as there is talk of new versions where there is no \u201ckill switch.\u201d<\/p>\n

Can it affect my plant PCs? <\/strong>
\nThe answer is yes; in fact, these are the PCs that tend to be more vulnerable, due to the lack of updating and patching they suffer, and the widespread use of old operating systems.<\/p>\n

All versions of Windows up to Windows 8 and WServer 2012 are vulnerable without the patch<\/strong>. That includes all Windows Server 2003, Windows Server 2008, Windows Vista, XP, and Windows 7. OS widely extended in the plant and in which the automatic update of patches tends to be deactivated. <\/p>\n

\"\"<\/p>\n

What should I do? <\/strong>
\nBelow, the actions are separated into two blocks: prevention and detection.<\/p>\n

1. Prevention Actions<\/strong>
\na. Immediately install the Microsoft patch for the MS17-010 vulnerability:
\nhttps:\/\/technet.microsoft.com\/en-us\/library\/security\/ms17-010.aspx<\/a>
\nb. Disable old protocols including SMBv1.
\nc. Block incoming connections to SMB ports (139 and 445) from computers external to the network.
\nd. Isolate as much as possible computers that are Windows unsupported.
\ne. Update the signature databases of antivirus systems.
\nf. Perform backups of the systems, and have them updated.
\ng. Deploy specific protection to endpoints that cannot be patched.
\nh. Do not use accounts with administrator permissions. <\/em><\/p>\n

2. Detection Actions<\/strong>
\na. Deploy IDS\/IPS systems on the network, with updated signatures, for the detection of \u201cEternalBlue.\u201d
\nb. Verify that the endpoints have the latest signatures.
\nc. Verify that there is no TOR traffic on our network; this could indicate an infection.
\nd. Check the DNS log for traces related to the malware. <\/em><\/p>\n

What best practices can I adopt to prevent Ransomware? <\/strong>
\nFinally, and directly extracted from the document \u201cBuenas Pr\u00e1cticas CCN-CERT BP-04\/16\u201d of the CCN-Cert, since it seems very complete to me, a series of good practices are exposed below, which it is recommended to always take into account as far as possible to prevent the infection and spread of ransomware.<\/p>\n

    \n
  1. Maintain periodic backups of all important data.<\/strong> It is necessary to keep these copies isolated and without connectivity to other systems,
    \nthus avoiding access from infected computers.<\/li>\n
  2. Keep the system updated<\/strong> with the latest security patches, both for the operating system and for the software that has been installed.<\/li>\n
  3. Maintain a first line of defense with the latest malicious code signatures<\/strong> (antivirus), in addition to having a correct configuration of the
    \nfirewalls at the application level (based on whitelists of allowed applications).<\/li>\n
  4. Have antispam systems<\/strong> at the email level and establish a high filtering level; in this way, the chances of infection through
    \nmassive ransomware campaigns by email are reduced.<\/li>\n
  5. Establish security policies in the system<\/strong> to prevent the execution of files from directories commonly used by ransomware (App Data,
    \nLocal App Data, etc.). Tools such as AppLocker, Cryptoprevent, or CryptoLocker Prevention Kit allow you to easily create these policies.<\/li>\n
  6. Block traffic related to C2 domains and servers<\/strong> through an IDS\/IPS, thus avoiding communication between the malicious code and the command and control server.\n<\/li>\n
  7. Establish an in-depth defense using tools such as EMET<\/strong>, a solution that allows mitigating exploits (including 0-days).
    \nDo not use accounts with administrator privileges, reducing the potential impact of the action of a ransomware.<\/li>\n
  8. Maintain access control lists for network-mapped drives<\/strong>. In case of infection, the encryption will occur on all network drives
    \nmapped on the victim’s computer. Restricting write privileges on the network will partially mitigate the impact <\/li>\n
  9. The use of Javascript blockers for the browser is recommended<\/strong>, such as “Privacy Manager”, which prevents the execution of all those
    \nscripts that may cause damage to our computer. In this way, we will reduce the options of infection from the web (Web Exploit Kits). <\/li>\n
  10. Show extensions for known file types<\/strong>, in order to identify possible executable files that could pass themselves off as another type of file.<\/li>\n<\/ol>\n

    \"\"<\/p>\n

    Additionally, it is recommended to install the tool “Anti Ransom”<\/strong>, which will try to block the encryption process of a ransomware<\/strong> (monitoring “honey files”). In addition, this application will perform a memory dump of the malicious code at the time of its execution, in which, with luck, the encryption key that was being used can be found. <\/p>\n

    Finally, the use of virtual machines will avoid infection by ransomware in a high percentage of cases<\/strong>. Due to the anti-debug and anti-virtualization techniques commonly present in this type of malicious code, it has been shown that in a virtualized environment its action does not materialize. <\/p>\n

    As a final conclusion, it is important to keep in mind that new attacks are expected<\/strong>, and that for this reason the adoption of security measures is important<\/strong> to prevent and detect this type of attack. In addition, it is important to add that the human factor plays a crucial role, since social engineering tends to be one of the key factors. <\/p>\n","protected":false},"excerpt":{"rendered":"

    The massive attack last Friday, May 12, is now globally known. A ransomware, WannaCry\/WannaCrypt0r, has spread worldwide. We tell you a series of Recommendations and good practices to deal with it. <\/p>\n","protected":false},"author":31,"featured_media":60269,"menu_order":0,"template":"","categories":[1371],"tags":[],"arquitectura":[1839],"area":[],"sector":[],"experto":[1396],"weborigen":[157],"productos-tax":[],"soluciones-tax":[],"marcas-tax":[],"coauthors":[],"class_list":["post-60263","blog","type-blog","status-publish","has-post-thumbnail","hentry","category-cybersecurity","arquitectura-industrial-cybersecurity","experto-industrial-cybersecurity-total-availability","weborigen-ciberseguridadlogitek-com"],"acf":[],"yoast_head":"\nRecommendations and best practices Ransomware WannaCry<\/title>\n<meta name=\"description\" content=\"The massive attack last Friday, May 12, is now globally known. A ransomware, WannaCry\/WannaCrypt0r, has spread worldwide. What can we do?\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/becolve.com\/en\/blog\/recommendations-and-best-practices-for-ransomware-wannacry\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Recommendations and best practices Ransomware WannaCry\" \/>\n<meta property=\"og:description\" content=\"The massive attack last Friday, May 12, is now globally known. A ransomware, WannaCry\/WannaCrypt0r, has spread worldwide. What can we do?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/becolve.com\/en\/blog\/recommendations-and-best-practices-for-ransomware-wannacry\/\" \/>\n<meta property=\"og:site_name\" content=\"Becolve Digital\" \/>\n<meta property=\"og:image\" content=\"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/ransome.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"300\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@Logitek_es\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"5 minutes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"Becolve Digital\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/recommendations-and-best-practices-for-ransomware-wannacry\\\/\",\"url\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/recommendations-and-best-practices-for-ransomware-wannacry\\\/\",\"name\":\"Recommendations and best practices Ransomware WannaCry\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/recommendations-and-best-practices-for-ransomware-wannacry\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/recommendations-and-best-practices-for-ransomware-wannacry\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/ransome.jpg\",\"datePublished\":\"2025-09-26T11:02:44+00:00\",\"description\":\"The massive attack last Friday, May 12, is now globally known. A ransomware, WannaCry\\\/WannaCrypt0r, has spread worldwide. What can we do?\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/recommendations-and-best-practices-for-ransomware-wannacry\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/recommendations-and-best-practices-for-ransomware-wannacry\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/recommendations-and-best-practices-for-ransomware-wannacry\\\/#primaryimage\",\"url\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/ransome.jpg\",\"contentUrl\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/ransome.jpg\",\"width\":800,\"height\":300},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/recommendations-and-best-practices-for-ransomware-wannacry\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/becolve.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Blog Items\",\"item\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Recommendations and Best Practices for Ransomware WannaCry\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/becolve.com\\\/en\\\/\",\"name\":\"Becolve Digital\",\"description\":\"Transformaci\u00f3n digital en industria e infraestructuras\",\"publisher\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/becolve.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#organization\",\"name\":\"Becolve Digital\",\"url\":\"https:\\\/\\\/becolve.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/becolve-logo-h-black_200.png\",\"contentUrl\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/becolve-logo-h-black_200.png\",\"width\":200,\"height\":64,\"caption\":\"Becolve Digital\"},\"image\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Logitek_es\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/becolve-digital\\\/\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Recommendations and best practices Ransomware WannaCry","description":"The massive attack last Friday, May 12, is now globally known. A ransomware, WannaCry\/WannaCrypt0r, has spread worldwide. What can we do?","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/becolve.com\/en\/blog\/recommendations-and-best-practices-for-ransomware-wannacry\/","og_locale":"en_US","og_type":"article","og_title":"Recommendations and best practices Ransomware WannaCry","og_description":"The massive attack last Friday, May 12, is now globally known. A ransomware, WannaCry\/WannaCrypt0r, has spread worldwide. What can we do?","og_url":"https:\/\/becolve.com\/en\/blog\/recommendations-and-best-practices-for-ransomware-wannacry\/","og_site_name":"Becolve Digital","og_image":[{"width":800,"height":300,"url":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/ransome.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_site":"@Logitek_es","twitter_misc":{"Est. reading time":"5 minutes","Written by":"Becolve Digital"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/becolve.com\/en\/blog\/recommendations-and-best-practices-for-ransomware-wannacry\/","url":"https:\/\/becolve.com\/en\/blog\/recommendations-and-best-practices-for-ransomware-wannacry\/","name":"Recommendations and best practices Ransomware WannaCry","isPartOf":{"@id":"https:\/\/becolve.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/becolve.com\/en\/blog\/recommendations-and-best-practices-for-ransomware-wannacry\/#primaryimage"},"image":{"@id":"https:\/\/becolve.com\/en\/blog\/recommendations-and-best-practices-for-ransomware-wannacry\/#primaryimage"},"thumbnailUrl":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/ransome.jpg","datePublished":"2025-09-26T11:02:44+00:00","description":"The massive attack last Friday, May 12, is now globally known. A ransomware, WannaCry\/WannaCrypt0r, has spread worldwide. What can we do?","breadcrumb":{"@id":"https:\/\/becolve.com\/en\/blog\/recommendations-and-best-practices-for-ransomware-wannacry\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/becolve.com\/en\/blog\/recommendations-and-best-practices-for-ransomware-wannacry\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/becolve.com\/en\/blog\/recommendations-and-best-practices-for-ransomware-wannacry\/#primaryimage","url":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/ransome.jpg","contentUrl":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/ransome.jpg","width":800,"height":300},{"@type":"BreadcrumbList","@id":"https:\/\/becolve.com\/en\/blog\/recommendations-and-best-practices-for-ransomware-wannacry\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/becolve.com\/en\/"},{"@type":"ListItem","position":2,"name":"Blog Items","item":"https:\/\/becolve.com\/en\/blog\/"},{"@type":"ListItem","position":3,"name":"Recommendations and Best Practices for Ransomware WannaCry"}]},{"@type":"WebSite","@id":"https:\/\/becolve.com\/en\/#website","url":"https:\/\/becolve.com\/en\/","name":"Becolve Digital","description":"Transformaci\u00f3n digital en industria e infraestructuras","publisher":{"@id":"https:\/\/becolve.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/becolve.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/becolve.com\/en\/#organization","name":"Becolve Digital","url":"https:\/\/becolve.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/becolve.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/becolve-logo-h-black_200.png","contentUrl":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/becolve-logo-h-black_200.png","width":200,"height":64,"caption":"Becolve Digital"},"image":{"@id":"https:\/\/becolve.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Logitek_es","https:\/\/www.linkedin.com\/company\/becolve-digital\/"]}]}},"_links":{"self":[{"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/blog\/60263","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/blog"}],"about":[{"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/types\/blog"}],"author":[{"embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/users\/31"}],"version-history":[{"count":0,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/blog\/60263\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/media\/60269"}],"wp:attachment":[{"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/media?parent=60263"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/categories?post=60263"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/tags?post=60263"},{"taxonomy":"arquitectura","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/arquitectura?post=60263"},{"taxonomy":"area","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/area?post=60263"},{"taxonomy":"sector","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/sector?post=60263"},{"taxonomy":"experto","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/experto?post=60263"},{"taxonomy":"weborigen","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/weborigen?post=60263"},{"taxonomy":"productos-tax","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/productos-tax?post=60263"},{"taxonomy":"soluciones-tax","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/soluciones-tax?post=60263"},{"taxonomy":"marcas-tax","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/marcas-tax?post=60263"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/coauthors?post=60263"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}