Two years on, WannaCry remains in thousands of networks globally, despite available patches; researcher: “kill switch” stopped ~60M WannaCry detonations in June
Context & Ripple Effects
When the researcher registered the hardcoded domain in May 2017, it acted as an accidental kill switch that halted WannaCry's spread — days after Europol counted 200K infected machines across 150 countries. Attackers immediately tried to undo that luck, directing Mirai-based botnets at the kill-switch domain to knock it offline and revive the ransomware.
Two years later, TechCrunch reports the picture is unresolved: patches have existed since the outbreak, yet WannaCry still sits in thousands of networks worldwide, and the same kill switch prevented roughly 60 million detonations in June alone. The malware never died — it was only ever suspended.
First-order effects
- Organizations still running unpatched machines remain exposed today: the 60M June detonations show active infection attempts are ongoing, not historical residue.
- The kill-switch registrant carries a permanent operational burden — taking the domain down or losing it would re-arm the ransomware across every infected network.
Second-order effects
- Attackers' earlier attempt to DDoS the kill-switch domain shows the countermeasure itself is now a target, meaning defenders must keep protecting a single point of failure two years after the emergency passed.
- Persistent infections keep pressure on network operators to audit legacy systems rather than treat the 2017 patch cycle as closed.
Third-order effects
- If ransomware strains routinely ship with kill switches or other built-in abort mechanisms, incident response increasingly hinges on whoever controls those levers — a fragile dependency for global remediation.
- The two-year persistence of a fully patched worm points toward structural hygiene problems: large installed bases of unpatched systems that turn one-time outbreaks into standing risk.
The trend: Ransomware is shifting from episodic outbreaks toward persistent background infection, with remediation dependent on single-point countermeasures like hardcoded kill switches.