【Netherlands】

When it comes to online currency,Netherlands lulz just might outvalue Bitcoin.

A unknown group of hackers is working behind the scenes to restart the ransomware WannaCry, and one security expert believes the culprits this time around aren't who you think.

And neither is their motivation.

SEE ALSO: It won't be easy for WannaCry hackers to get their cash

Contrary to what you might expect, it appears not to be the initial group responsible for WannaCry now working to startle the ransomware monster awake from its slumber. Rather, we may have some internet randos to thank.

Why? The leading theory, proposed by security researcher Marcus Hutchins, suggests it's all about shits and giggles.

WannaCry rushed onto the international scene on May 12, infecting and encrypting hundreds of thousands of computer systems running unpatched Windows operating systems. The ransomware demanded that victims pay around $300 in the cryptocurrency Bitcoin to their attackers if they ever wanted to see their files again.

"Yeah, it's most likely scriptkiddies doing it for lulz."

Some paid up, but computers stayed encrypted.

And while the damage was bad — England's National Health Service was hit particularly hard — it could have been a lot worse. The ransomware -- which utilized a stolen NSA exploit called EternalBlue -- stopped spreading when Hutchins registered a mysterious domain he discovered in the malware code and sinkholed it.

Hutchins explained the process on his blog, noting that "a sinkhole is a server designed to capture malicious traffic and prevent control of infected computers by the criminals who infected them."

Mashable Light Speed Want more out-of-this world tech, space and science stories? Sign up for Mashable's weekly Light Speed newsletter. By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy. Thanks for signing up!

Hutchins means business. Credit: AP/REX/Shutterstock

The ransomware, it seems, was designed to contact Hutchins' domain before it spread to the next victim. Hutchins' registration of that domain created a kind of kill switch — effectively telling WannaCry to stop spreading.

As long as that domain, and one other discovered and sinkholed by a different researcher, remain up and active the ransomware won't spread. Which brings us back to our lulz-pirates.

Hutchins has observed an intentional distributed denial of service attack aimed at his domain with the apparent goal of knocking it offline. Wiredreports that the traffic appears to be coming courtesy of the Mirai botnet — the same botnet, comprised of IoT devices like wireless security cameras, that brought down parts of the internet in the fall of 2016.

This Tweet is currently unavailable. It might be loading or has been removed.

Why would anyone do this? Could the initial WannaCry developers simply want more computers infected with the hope of making more money? Probably not.

As Hutchins confirmed via Twitter direct message, the initial attackers can't appear to even keep up with the volume of decryption requests they've already received.

"[The] decryption system is stupid and completely unscalable," he observed.

In other words, infecting more computers won't exactly translate to more Bitcoin in their wallets. That leaves another possibility: someone just looking to mess with people.

"Yeah, it's most likely scriptkiddies doing it for lulz," Hutchins further speculated — using a term that refers to relatively low-skilled hackers.

So there you have it. If someone manages to knock Hutchins' sinkhole offline, allowing WannaCry to spread further in the process, you'll likely have some random prankster with a messed up sense of humor to thank.

But don't stress about it too much. "The DDoS is unlikely to be successful," reassures Hutchins.

Phew. Now if only Hutchins could solve our other internet security problems.

---

Featured Video For You

---

This lightbulb levitates and could last up to 22 years

---

Topics Cybersecurity

• Shopping
• Tech
• Social Good
• Science
• Digital Culture
• Life
• Deals
• Entertainment

• Robin Triumphant
• The loss of Twitter's free API tier is a blow to activists and researchers.
• For one beautiful night, #fartgate actually united all of Twitter
• For one beautiful night, #fartgate actually united all of Twitter
• Exceptionally rare radio sources detected in the distant universe
• The loss of Twitter's free API tier is a blow to activists and researchers.
• 'The Last of Us' episode 4 had one hell of a game actor cameo
• Here's why Twitter users are all posting Twitter Spaces links in their tweets
• The fat bears are already extremely fat
• Shelter cat gets a timeout for helping other cats escape 'several times a day'

• Man gets revenge on rude people in coffee shop with a hilarious power move
• Can Google Ads data predict the next coronavirus outbreak?
• Disney Springs partially reopened with new social distancing rules
• Leaked Microsoft Surface Duo specs, if true, aren't all that exciting
• Can UV light sanitize hotel and Airbnb rooms?
• Fred Willard, comic legend from 'Best in Show,' is dead at 86
• China looks to retaliate against U.S. over ‘unreasonable suppression’ of Huawei
• Shine line hair will turn your head into a beautiful rainbow
• TNT's 'Snowpiercer' takes too long to pick up speed: Review
• Twitter tests feature that limits who can respond to tweets

• 'The Last of Us' Season 2, episode 5: The spores are here!
• ChatGPT creator OpenAI’s classifier for AI
• WhatsApp is letting users post voice notes as statuses
• 'The Last of Us' episode 4 had one hell of a game actor cameo
• Is it 'Thunderbolts*' or *The New Avengers'?
• How to watch 'Black Panther: Wakanda Forever'
• How are we regulating ChatGPT and other AI tools?
• What are Facebooks new comment moderation tool updates?
• How to Easily Make iPhone Ringtones Using Only iTunes
• Here's why Twitter users are all posting Twitter Spaces links in their tweets

• This fat bear's before and after photos are stunning
• Chrissy Teigen calls out Donald Trump Jr.'s suspiciously amazing book sales
• Samsung Galaxy S23 phone cases: 10 unique options for Samsung's new phones
• Twitter may soon charge brands $1000 to keep gold checkmark
• NYT Connections Sports Edition hints and answers for May 18: Tips to solve Connections #237
• 20 Thanksgiving horror stories to stress you out before the big day
• Trump's unexpected hospital trip has Twitter conspiracies in overdrive
• This is the most annoying bong ever made
• How to Easily Make iPhone Ringtones Using Only iTunes
• Busy Philipps talks Marvel movies and essential travel tips