How The Activity Unfolds In ATT&CK
WannaCry is the classic outbreak pattern: remote propagation, payload transfer, encryption, and recovery pressure. It is less subtle than espionage activity, but the ATT&CK flow is useful because it shows why impact can arrive quickly after exploitation.
- T1210 Exploitation Of Remote Services. The activity spreads through vulnerable remote service exposure.
- T1105 Ingress Tool Transfer. Components move into newly affected systems as the outbreak propagates.
- T1486 Data Encrypted For Impact. Files are encrypted to create operational disruption.
- T1490 Inhibit System Recovery. Ransomware pressure depends on limiting simple recovery paths.
Defender Readout
This entry stays in the top set because it is still a reference case for patch exposure, lateral propagation, ransomware blast radius, and recovery planning.
Evidence And Mapping Rationale
WannaCry ransomware
CISA's alert centers on the outbreak; exploitation of remote services is the behavior used to explain its worm-like spread.
Indicators Associated With WannaCry
Malware components and payload movement fit ATT&CK ingress transfer during propagation.
ransomware
The core user-facing effect was encryption of victim data for impact.
ransomware
Recovery inhibition is a common ransomware impact behavior documented in analysis of the outbreak.