The U.S. Government publicly attributed the WannaCry ransomware variant to North Korea, and CISA linked the activity to its broader Hidden Cobra reporting. WannaCry spread globally through the MS17-010/EternalBlue SMBv1 exploit, encrypting files and demanding a bitcoin ransom. US-CERT analysis found that the dropper contacted a hard-coded kill-switch domain, installed itself as the `mssecsvc2.0` service, scanned SMB-related ports, and propagated to systems exposing TCP port 445. CISA urged organizations to patch MS17-010, disable SMBv1 where feasible, segment networks, and maintain tested offline backups.