Wanna Ransomware Attack Update from Sophos

A significant number of organizations have been affected by a virulent new ransomware variant, Wanna, which is also known by a number of alias names including WanaCrypt0r. We wanted to contact you proactively to offer our advice and support during this period.

We have a range of resources to help Sophos customers stay protected from this attack.

Wanna Resources

Sophos protection

Sophos Intercept X, Sophos Exploit Prevention (EXP), and Sophos Server Protection Advanced customers were protected proactively against Wanna ransomware from the first instance. Watch Intercept X in action against Wanna.

During Friday May 12th and Saturday May 13th, we updated our protection rules and Sophos Endpoint products now block all known variants of Wanna from executing.

Customer advice

We recommend all customers follow the steps below. Wanna exploits a Windows vulnerability in SMB for which Microsoft released a patch in March. It is highly likely that new attacks will appear based on the leaked exploit and is therefore critical to patch this vulnerability at the first opportunity (step 1).

1.	Update all Windows environments as described in Microsoft Security Bulletin MS17-010
2.	Whitelist specific domains related to this attack
3.	Update your endpoint software. Sophos customers are protected from this outbreak
4.	Ensure you are running advanced ransomware protection such as Intercept X
5.	Home users should consider signing up for the Sophos Home Premium beta, which adds protection from ransomware

Further reading

Additional useful resources you may find useful include:

•	Sophos Knowledgebase article: Wanna ransomware
•	Microsoft TechNet: Customer guidance for WannaCrypt attacks
•	Sophos Whitepaper: How to stay protected against Ransomware

To Know More

Call 022-28034088 OR

Swan is a 26+ year old, IT infrastructure and facilities management company providing state-of-the-art IT solutions to large and medium enterprises.

Swan Solutions & Services (P) Ltd - 404 T-Square, 4th Floor, Saki Vihar Road, Andheri East, Above Kavish Ford Showroom, Mumbai 400 072; Tel. 022-28034088 ; Email :enquiry@swansol.com	www.swansol.com