WannaCry Ransomware: The $10.69 Kill Switch Story

php2shell patches (CVE-2026-109618 and CVE-2026-109619) for EOL PHP are out now. With sales replies slower than usual due to high demand, the fastest route to patched packages is to buy ELS for Runtimes online (opens in new tab). Read the patch FAQ

Go straight to an AI summary of this blog post instead

  • Summarize this post with Perplexity
  • Summarize this post with Gemini

On May 12, 2017, screens around the world turned red.

Forty-eight UK hospitals turned away ambulances. FedEx halted deliveries. Renault stopped production lines in France. Nissan in Sunderland. Telefónica in Madrid. Deutsche Bahn departure boards in Germany. Surgeries cancelled. Logistics networks stalled.

In a matter of hours, more than 200,000 computers across 150 countries were locked behind the same message:

Oops, your files have been encrypted.

The ransomware was called WannaCry.

And in the middle of the chaos, far from a government command center or a corporate incident response room, a 22-year-old surfer and self-taught cybersecurity researcher in Ilfracombe, England, noticed something strange buried in the code.

A long, meaningless-looking web address.

He bought it for $10.69.

What happened next made him famous.

What happened three months later made the story impossible to forget.

That is the story behind Issue #4 of the TuxCare True Cyber Crime Comic Book Series: WANNACRY.

WannaCry was not supposed to move this fast

Most ransomware needs a victim to make the first mistake.

A bad attachment. A malicious link. One careless click.

WannaCry did not need any of that.

It spread on its own by exploiting a vulnerability in Microsoft’s SMBv1 protocol, using EternalBlue – a powerful exploit developed by the NSA and later leaked by the Shadow Brokers in April 2017. Once WannaCry found one vulnerable Windows machine, it hunted for the next one automatically. And then the next. And then the next.

Within hours, the worm had moved through hospitals, factories, logistics companies, telecoms, and public infrastructure. The UK’s NHS was hit especially hard. FedEx, Nissan, Renault, and others watched systems disrupted in real time. Security teams everywhere were suddenly racing a piece of malware that did not wait for humans to catch up.

The most uncomfortable part?

The patch already existed.

Microsoft had released MS17-010 on March 14, 2017 – two months before the outbreak. The NHS wasn’t hit because the patch didn’t exist. It was hit because the patch hadn’t been applied. Across the real world – inside hospitals, factories, and aging infrastructure – patches don’t get clicked into production just because they were published. Some systems are old. Some are fragile. Some are business-critical. Some sit in corners with an unofficial warning everyone understands: do not reboot unless absolutely necessary.

WannaCry turned that everyday operational compromise into a global emergency.

The kill switch nobody expected

The protagonist of Issue #4 is Marcus Hutchins, known online as MalwareTech.

On the morning WannaCry spread, Hutchins was not standing behind a podium or coordinating a global response team. He was at home, investigating the malware from his own setup, trying to understand what the world was dealing with.

Then he found the domain.

A long, garbled, unregistered web address hardcoded into the ransomware: iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com.

He registered it for ten dollars and sixty-nine cents, thinking it might help him monitor the outbreak.

Instead, he activated WannaCry’s kill switch.

Once the domain began resolving, the worm’s global spread slowed dramatically. A $10.69 purchase had helped stop one of the most destructive cyberattacks in history – and capped the attackers’ total take at roughly $143,000. Pocket change for an operation that should have generated tens of millions and shut down half the planet’s hospitals on the way.

A surfer in a seaside town. A leaked cyber weapon loose on the internet. A strange domain name. A global crisis interrupted by curiosity, instinct, and a credit card.

That is exactly why this story belongs in a comic.

But this is not a clean hero story

The popular version of WannaCry is simple: a young British researcher saved the internet.

That version is true. It is also incomplete.

Three months after the attack, Hutchins traveled to Las Vegas for DEF CON, the world’s most famous hacker conference. By then, he had become a cybersecurity celebrity – the accidental hero who helped stop WannaCry.

Then, at the airport on his way home, the FBI arrested him.

Not for WannaCry. For something else entirely – something from an older version of his life.

That is where WANNACRY becomes more than a cyberattack retelling.

It becomes a story about talent, consequence, redemption, and the strange moral terrain of cybersecurity – where the same technical mind that can build malware may also be the one capable of stopping it.

Hutchins is not presented as a flawless hero. The FBI is not presented as a cartoon villain. The courtroom does not give the story a simple ending.

The line between attacker and defender is not always bright. Sometimes it is drawn later, through choices, consequences, and what someone decides to do with their skill once they understand its weight.

That blurred line is the heart of Issue #4.

Why we turned WannaCry into a comic

Cybersecurity history is full of stories that get flattened into conference slides and timeline bullets.

WannaCry deserves better.

It has everything: a leaked NSA cyber weapon, a self-replicating ransomware worm, hospitals under pressure, a mysterious kill switch, a young researcher thrown into fame, and an airport arrest that recontextualized the entire narrative.

But more importantly, it still matters.

WannaCry was a preview of what happens when powerful exploits meet aging, unpatched infrastructure. It showed how quickly technical debt becomes operational crisis. It showed that security cannot depend on luck, heroics, or one researcher noticing the right string at the right time. MS17-010 was published. It just didn’t get applied.

Security has to be maintained.

Every day. Across every system. For as long as that system remains in production.

That lesson is still urgent – maybe more urgent now than it was in 2017.

Read Issue #4: WANNACRY

WANNACRY, the fourth installment of the award-winning TuxCare True Cyber Crime Comic Book Series, tells the story with the scale, tension, and visual imagination it deserves.

A wave becomes data. A ransomware worm becomes a missile strike. A bedroom investigation collides with a federal case. A global cyber crisis turns into a story about the people behind the code.

It is six pages of true cyber crime – drawn for people who know the stakes, but still love a great story.

Download WANNACRY (Issue #4) and find out what the FBI actually wanted with the man who saved the internet.

Summary
WannaCry Ransomware: The $10.69 Kill Switch Story
Article Name
WannaCry Ransomware: The $10.69 Kill Switch Story
Description
Read Issue #4 of TuxCare’s True Cyber Crime comic series – the story of WannaCry, the $10.69 kill switch, and the hacker whose past caught up with him.
Author
Publisher Name
TuxCare
Publisher Logo

Join 4,500+ Linux & Open Source Professionals!

2x a month. No spam.

Table of Contents
Get the open-source security answers you need

Join 4,500+ Linux & Open Source Professionals!

2x a month. No spam.