In colleges and universities in China, some students sometimes need to close the firewall in order to play LAN games, which is also the reason why this incident has spread widely in colleges and universities in China.

From the evening of May 12, teachers and students in many universities in China found that files and programs in their computers could not be opened, but a dialog box popped up, asking for a ransom such as bitcoin to be restored.

More than a dozen colleges and universities such as Shandong University, Nanchang University, Guangxi Normal University, Dongbei University of Finance and Economics, and Zhongshan College of University of Electronic Science and Technology of China issued virus attack notices to remind teachers and students to take precautions.

Some colleges and universities have reported that many colleges and universities in China have been infected with onion blackmail virus recently, and the disk files will be encrypted by the virus. Onion suffix Only by paying a high ransom can the recovered documents be decrypted, which has caused serious losses to study materials and personal data. According to the Cyber Security Bureau, this is a virus attack initiated by criminals using the "eternal blue" leaked from the NSA hacker arsenal.