FOLLOW US

Investigators might also be able to extract some information about the attacker from a previously hidden internet address connected to WannaCry’s “kill switch.” That switch was essentially a beacon sending the message “hey, I’m infected” to the hidden address, Weaver said.

That means the very first attempts to reach that address, which might have been recorded by spy agencies such as the NSA or Russian intelligence, could lead to “patient zero” — the first computer infected with WannaCry. That, in turn, might further narrow the focus on possible suspects.

___

THE PLAYERS

Forensics, though, will only get investigators so far. One challenge will be sharing intelligence in real time to move as quickly as the criminals — a tricky feat when some of the major nations involved, such as the U.S. and Russia, distrust each other.

Even if the perpetrators can be identified, bringing them to justice could be another matter. They might be hiding out in countries that wouldn’t be willing to extradite suspects for prosecution.

“It can take months or even years to gather all the evidence and build a case,” said Costin Raiu, head of Kaspersky’s global research and analysis.

___

Anick Jesdanun and Barbary Ortutay in New York, Lori Hinnant in Paris and Deb Riechmann in Washington contributed to this story.