[3rd Update]WCry ransomwsre has possible links to Lazarus Group & PRNK

[WMGroomAK]

On 5/16/2017 at 3:54 AM, Master Disaster said:

Updated OP again with new info about possible PRNK links

Have to admit that this is a bit bigger of an issue if it's true...  It would appear that the ransomware has infected an actual piece of medical hardware that is running Windows Embedded OS.  

 

https://www.bleepingcomputer.com/news/security/wannacry-ransomware-infects-actual-medical-devices-not-just-computers/

 

Quote

Reports have surfaced that the WannaCry ransomware has infected actual medical devices, not just computers at medical facilities.

 

An image of one such infection has been passed to a Forbes reporter on Wednesday. The infected medical device was a Bayer Medrad, radiology equipment that injects contrast agents inside the human body to aid in MRI scans.

 

The WannaCry ransomware infected this system because it was running on a version of the Windows Embedded operating system and supporting the SMBv1 protocol, WannaCry's initial point of infection.

 

Forbes Article:  https://www.forbes.com/sites/thomasbrewster/2017/05/17/wannacry-ransomware-hit-real-medical-devices/#50cbe5cc425c