- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
-
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
-
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
-
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
-
- Support Widget
How do I check that I am protected against the WannaCry Ransomware Attack?
10/14/2021 
1,039 People found this article helpful
101,137 Views
Description
If you are a SonicWall customer, and you have an active Gateway Anti-Virus subscription, your SonicWall firewall has been protecting your network from WannaCry (also known as WanaCrypt0r or WannaCrypt) ransomware since April 20, 2017.
This article explains how to check that your Gateway Anti-Virus is up to date with the correct signatures to protect your network against the WannaCry/WannaCrypt attack.
WannaCrypt.RSM is a Trojan. A Trojan is a program that pretends to have a valid use, but in fact modifies the user's computer in malicious ways. Trojans do not replicate or spread to other computers.
Resolution
Resolution for SonicOS 6.5
This release includes significant user interface changes and many new features that are different from the SonicOS 6.2 and earlier firmware. The below resolution is for customers using SonicOS 6.5 firmware.
For full details about the WannaCry Ransomware Attack you can read our SonicALERT.
Here's how to check that your Gateway Anti-Virus status has been updated since SonicWall first identified this virus and added the appropriate signatures to our databases:
- Login to your SonicWall firewall
- Click Manage in the top navigation menu.
- Navigate to Security Configuration | Security Services | Gateway Anti-Virus .
- Check that the Signature Database Timestamp is April 20th or later.
You can also check for the below signatures by using the Lookup Signatures Containing String section on the same page.
SonicWall covers multiple variants of this threat via the following signatures:
- GAV: WannaCrypt.RSM (Trojan)
- GAV: WannaCrypt.RSM_2 (Trojan)
- GAV: WannaCrypt.RSM_3 (Trojan)
- GAV: HydraCrypt.C (Trojan)
Since SonicWall Email Security uses the same signatures/definitions as UTM Gateway Security, we can effectively block the emails that deliver the initial route to infection. Ensure all email security services are also up to date to block malicious emails.
SonicWall has also released the following blog statement about this Ransomware Attack:
https://blog.sonicwall.com/2017/05/sonicwall-protects-customers-latest-massive-wannacry-ransomware-attack/
Resolution for SonicOS 6.2 and Below
The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.
For full details about the WannaCry Ransomware Attack you can read our SonicALERT.
Here's how to check that your Gateway Anti-Virus status has been updated since SonicWall first identified this virus and added the appropriate signatures to our databases:
- In your SonicWall firewall, go to Security Services.
- Click Gateway Anti-Virus.
- Check that the Signature Database Timestamp is April 20th or later.
You can also check for the below signatures by using the Lookup Signatures Containing String section on the same page.
SonicWall covers multiple variants of this threat via the following signatures:
- GAV: WannaCrypt.RSM (Trojan)
- GAV: WannaCrypt.RSM_2 (Trojan)
- GAV: WannaCrypt.RSM_3 (Trojan)
- GAV: HydraCrypt.C (Trojan)
Since SonicWall Email Security uses the same signatures/definitions as UTM Gateway Security, we can effectively block the emails that deliver the initial route to infection. Ensure all email security services are also up to date to block malicious emails.
SonicWall has also released the following blog statement about this Ransomware Attack:
https://blog.sonicwall.com/2017/05/sonicwall-protects-customers-latest-massive-wannacry-ransomware-attack/
Related Articles
- How to configure SSLVPN Tunnel all mode for one or more particular users (Local or Domain users)
- How to disable TOTP for a Local User with admin privileges via CLI.
- Parserror on Event logs.
Categories
- Firewalls > SonicWall NSA Series
- Firewalls > SonicWall SuperMassive 9000 Series
- Firewalls > SonicWall SuperMassive E10000 Series
- Firewalls > TZ Series
YES
NO