<p><div><div><div><div data-width="100" data-show-faces="false" data-send="true" data-layout="button_count" data-height="21" data-href="https://www.r-bloggers.com/r%e2%81%b6-tracking-wannacry-bitcoin-wallet-payments-with-r/"></div></div><div></div></div><div></div></div>
<div>
(This article was first published on <strong><a href="https://rud.is/b/2017/05/14/r%E2%81%B6-tracking-wannacry-bitcoin-wallet-payments-with-r/"> R – rud.is</a></strong>, and kindly contributed to <a rel="nofollow" href="https://www.r-bloggers.com/">R-bloggers)</a> </div>
<p>If you follow me on Twitter or monitor <a target="_blank" rel="nofollow" href="http://twitter.com/Rapid7">@Rapid7</a>’s <a target="_blank" rel="nofollow" href="https://community.rapid7.com/community/infosec/blog/2017/05/12/wanna-decryptor-wncry-ransomware-explained">Community Blog</a> you know I’ve been involved a bit in the WannaCry ransomworm triage.</p>
<p>One thing I’ve been doing is making charts of the hourly contribution to the Bitcoin addresses that the current/main attackers are using to accept ransom payments (which you really shouldn’t pay, now, even if you are impacted as it’s unlikely they’re actually giving up keys anymore because the likelihood of them getting cash out of the wallets without getting caught is pretty slim).<a target="_blank" rel="nofollow" href="https://i0.wp.com/rud.is/b/wp-content/uploads/2017/05/wanna1.png?ssl=1"><img alt="" class="wp-image-5948" src="https://i0.wp.com/rud.is/b/wp-content/uploads/2017/05/wanna1.png?resize=780%2C294&ssl=1" data-recalc-dims="1"></a></p>
<p>There’s a full-on CRAN-ified <a target="_blank" rel="nofollow" href="https://github.com/jangorecki/Rbitcoin"><code>Rbitcoin</code></a> package but I didn’t need the functionality in it (yet) to do the monitoring. I posted a hastily-crafted gist on Friday so folks could play along at home, but the code here is a bit more nuanced (and does more).</p>
<p>In the spirit of these R⁶ posts, the following is presented without further commentary apart from the interwoven comments.</p>
<pre><code>library(jsonlite)
library(hrbrthemes)
library(tidyverse)

# the wallets accepting ransom payments

wallets &lt;- c(
  &quot;115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn&quot;,
  &quot;12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw&quot;,
  &quot;13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94&quot;
)

# easy way to get each wallet info vs bringing in the Rbitcoin package

sprintf(&quot;https://blockchain.info/rawaddr/%s&quot;, wallets) %>%
  map(jsonlite::fromJSON) -> chains

# get the current USD conversion (tho the above has this, too)

curr_price &lt;- jsonlite::fromJSON(&quot;https://blockchain.info/ticker&quot;)

# calculate some basic stats

tot_bc &lt;- sum(map_dbl(chains, &quot;total_received&quot;)) / 10e7
tot_usd &lt;- tot_bc * curr_price$USD$last
tot_xts &lt;- sum(map_dbl(chains, &quot;n_tx&quot;))

# This needs to be modified once the counters go above 100 and also needs to
# account for rate limits in the blockchain.info API

paged &lt;- which(map_dbl(chains, &quot;n_tx&quot;) > 50)
if (length(paged) > 0) {
  sprintf(&quot;https://blockchain.info/rawaddr/%s?offset=50&quot;, wallets[paged]) %>%
    map(jsonlite::fromJSON) -> chains2
}

# We want hourly data across all transactions

map_df(chains, &quot;txs&quot;) %>%
  bind_rows(map_df(chains2, &quot;txs&quot;)) %>% 
  mutate(xts = anytime::anytime(time),
         xts = as.POSIXct(format(xts, &quot;%Y-%m-%d %H:00:00&quot;), origin=&quot;GMT&quot;)) %>%
  count(xts) -> xdf

# Plot it

ggplot(xdf, aes(xts, y = n)) +
  geom_col() +
  scale_y_comma(limits = c(0, max(xdf$n))) +
  labs(x = &quot;Day/Time (GMT)&quot;, y = &quot;# Transactions&quot;,
       title = &quot;Bitcoin Ransom Payments-per-hour Since #WannaCry Ransomworm Launch&quot;,
       subtitle=sprintf(&quot;%s transactions to-date; %s total bitcoin; %s USD; Chart generated at: %s EDT&quot;,
                        scales::comma(tot_xts), tot_bc, scales::dollar(tot_usd), Sys.time())) +
  theme_ipsum_rc(grid=&quot;Y&quot;)</code></pre>
<p>I hope all goes well with everyone as you try to ride out this ransomworm storm over the coming weeks. It will likely linger for quite a while, so make sure you patch!</p>
<p>
<div>
<div>To <strong>leave a comment</strong> for the author, please follow the link and comment on their blog: <strong><a href="https://rud.is/b/2017/05/14/r%E2%81%B6-tracking-wannacry-bitcoin-wallet-payments-with-r/"> R – rud.is</a></strong>.</div>
<hr>
<a rel="nofollow" href="https://www.r-bloggers.com/">R-bloggers.com</a> offers <strong><a rel="nofollow" href="https://feedburner.google.com/fb/a/mailverify?uri=RBloggers">daily e-mail updates</a></strong> about <a title="The R Project for Statistical Computing" rel="nofollow" href="https://www.r-project.org/">R</a> news and <a title="R tutorials" rel="nofollow" href="https://www.r-bloggers.com/search/tutorial">tutorials</a> on topics such as: <a title="Data science" rel="nofollow" href="https://www.r-bloggers.com/search/data%20science">Data science</a>, <a title="Big Data" rel="nofollow" href="https://www.r-bloggers.com/search/Big%20Data">Big Data, <a title="R jobs" rel="nofollow" href="https://www.r-users.com/">R jobs</a>, visualization (<a title="ggplot and ggplot2 tutorials" rel="nofollow" href="https://www.r-bloggers.com/search/ggplot2">ggplot2</a>, <a title="Boxplots using lattice and ggplot2 tutorials" rel="nofollow" href="https://www.r-bloggers.com/search/boxplot">Boxplots</a>, <a title="Maps and gis" rel="nofollow" href="https://www.r-bloggers.com/search/map">maps</a>, <a title="Animation in R" rel="nofollow" href="https://www.r-bloggers.com/search/animation">animation</a>), programming (<a title="RStudio IDE for R" rel="nofollow" href="https://www.r-bloggers.com/search/RStudio">RStudio</a>, <a title="Sweave and literate programming" rel="nofollow" href="https://www.r-bloggers.com/search/sweave">Sweave</a>, <a title="LaTeX in R" rel="nofollow" href="https://www.r-bloggers.com/search/LaTeX">LaTeX</a>, <a title="SQL and databases" rel="nofollow" href="https://www.r-bloggers.com/search/SQL">SQL</a>, <a title="Eclipse IDE for R" rel="nofollow" href="https://www.r-bloggers.com/search/eclipse">Eclipse</a>, <a title="git and github, Version Control System" rel="nofollow" href="https://www.r-bloggers.com/search/git">git</a>, <a title="Large data in R using Hadoop" rel="nofollow" href="https://www.r-bloggers.com/search/hadoop">hadoop</a>, <a title="Web Scraping of google, facebook, yahoo, twitter and more using R" rel="nofollow" href="https://www.r-bloggers.com/search/Web+Scraping">Web Scraping</a>) statistics (<a title="Regressions and ANOVA analysis tutorials" rel="nofollow" href="https://www.r-bloggers.com/search/regression">regression</a>, <a title="principal component analysis tutorial" rel="nofollow" href="https://www.r-bloggers.com/search/PCA">PCA</a>, <a title="Time series" rel="nofollow" href="https://www.r-bloggers.com/search/time+series">time series</a>, <a title="finance trading" rel="nofollow" href="https://www.r-bloggers.com/search/trading">trading</a>) and more...
<img height="1" alt="" width="1" src="http://feeds.feedburner.com/~r/RBloggers/~4/WO68LQuwONs"></a></div>