Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
WannaCry
As of Oct 19, 2026, WannaCry has listed 31 confirmed victims on its leak site since Jul 11, 2025, 0.1% of all victims tracked by Brandefense. Its most targeted country is United States (19.4% of its victims).
WannaCry ransomware is a cyber attack that spreads by exploiting vulnerabilities in the Windows operating system. At its peak in May 2017, WannaCry became a global threat. Cybercriminals used the ransomware to hold an organization's data hostage and extort money in the form of cryptocurrency. WannaCry spreads using EternalBlue, an exploit leaked from the National Security Agency (NSA). EternalBlue enables attackers to use a zero-day vulnerability to gain access to a system. It targets Windows computers that use a legacy version of the Server Message Block (SMB) protocol.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 31
- Rank By Victims
- #137
- Last Leak-Site Post
- Jul 11, 2025
- Top Country
- United States
- Top Sector
- Unknown
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 0 |
| December 2025 | 0 |
| January 2026 | 0 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| July 2025 | 31 |
| August 2025 | 0 |
| September 2025 | 0 |
| October 2025 | 0 |
| November 2025 | 0 |
| December 2025 | 0 |
| January 2026 | 0 |
| February 2026 | 0 |
| March 2026 | 0 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 0 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
Latest WannaCry Victims.
Search all 31 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| State of Connecticut (12 State Agencies, including the Department of Administrative Services) | USUnited States | Unknown | Not stated | |
| Becker County | USUnited States | Unknown | Not stated | |
| Telkom | ZASouth Africa | Unknown | Not stated | |
| Rensselaer County Library | USUnited States | Unknown | Not stated | |
| Cook County | USUnited States | Unknown | Not stated | |
| MediaOnline | SGSingapore | Unknown | Not stated |
How They Operate.
WannaCry's threat actor profile lists 1 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who WannaCry Targets.
Sectors
No data for this window right now.
History.
First seen in Brandefense data
Busiest month on record: 31 confirmed victims
First confirmed victim listed on its leak site
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.