EXHIBIT 0002 — WANNACRY

The patch had been out for eight weeks.

On Friday 12 May 2017, hospitals across England started turning patients away. Not a fire, not a flood — every screen in the building had changed to the same red wallpaper, misspelled at the top: "Ooops, your files have been encrypted!"

The payment window asked for $300 in Bitcoin. The note threatened to double it after three days.

What made WannaCry different from every ransomware before it is that nobody had to click anything. It was a worm. It found the next machine on its own, over the network, through a Windows file-sharing service listening on port 445. One unpatched laptop was enough to take the rest of the floor with it.

The hole it went through had a name — EternalBlue — and, crucially, a fix. Microsoft shipped it as MS17-010 on 14 March 2017. WannaCry arrived on 12 May. Eight weeks of warning, and it still reached at least 81 of England's 236 NHS trusts and 595 GP practices. An estimated 19,000 appointments were cancelled.

Then it stopped. A researcher pulling a sample apart noticed the malware pinging a long nonsense domain before it did anything else. The domain was unregistered. He bought it for $10.69. It answered. WannaCry read that as a signal to stand down and went quiet mid-outbreak, worldwide, for the price of a sandwich.

The details

Three Bitcoin wallets, hardcoded, assigned to victims at random — which meant the operators had no way of telling who had actually paid. "Check Payment" was a button that asked a human on the other end. Around $140,000 came in, against damages counted in the billions.

It was not an old-computer problem. Over 98% of infections were Windows 7 — supported, patchable, unpatched. Windows XP mostly blue-screened instead of spreading it.

The exploit had been dumped publicly a month earlier, on 14 April. The patch was already older than the leak. In December 2017, the US and UK governments publicly attributed the attack to North Korea.

The most expensive part of the whole incident was an update nobody installed.

Fit & print

- Gildan Softstyle® 64000, 100% ring-spun cotton in solid colors

- 4.5 oz/yd² (153 g/m²)

- Classic fit, crew neck, ribbed-knit collar

- Twill-tape reinforced shoulders, no side seams

- Pearlized tear-away label

- OEKO-TEX® STANDARD 100 certified (Certificate No. 168252, OETI)

- Cotton sourced under the US Cotton Trust Protocol

Heather colors are 35% cotton / 65% polyester. Sport Grey and Antique are 90% cotton / 10% polyester. Graphite Heather is 50/50. The White variant reads off-white rather than bright white — a property of the fabric, not the print.

Read the full technical breakdown in the archive.