Massive Ransom Attack Hits 99 Countries

A massive cyber attack using tools believed to have been stolen from the US National Security Agency (NSA) has struck organisations around the world.

Cyber-security firm Avast said it had seen 75,000 cases of the ransomware, known as WannaCry and variants of that name. There are reports of infections in 99 countries, including Russia and China.

Among the worst hit was the National Health Service (NHS) in England and Scotland. About 40 NHS organisations and some medical practices were hit, with operations and appointments cancelled.

The malware spread quickly on last Friday 12th May, with medical staff in the UK reportedly seeing computers go down "one by one". Throughout the day other, mainly European countries, reported infections.

A number of large Spanish firms - including telecoms giant Telefonica, power firm Iberdrola and utility provider Gas Natural - were hit, with reports that staff at the firms were told to turn off their computers.

Portugal Telecom, delivery company FedEx, a Swedish local authority and Megafon, the second largest mobile phone network in Russia, also said they had been affected. People tweeted photos of affected computers including a local railway ticket machine in Germany and a university computer lab in Italy.

Some reports said Russia had seen more infections than any other single country. Russia's interior ministry said it had "localised the virus" following an "attack on personal computers using Windows operating system".

Some security researchers have pointed out that the infections seem to be deployed via a worm - a program that spreads by itself between computers. Most other malicious programmes rely on humans to spread by tricking them into clicking on an attachment harbouring the attack code.

By contrast, once WannaCry is inside an organisation it will hunt down vulnerable machines and infect them too. 
This perhaps explains why its impact is so public - because large numbers of machines at each victim organisation are being compromised.

Who is behind the attack?

Some experts say the attack may have been built to exploit a weakness in Microsoft systems that was identified by the NSA and given the name EternalBlue.

The NSA tools were stolen by a group of hackers known as The Shadow Brokers, who then attempted to sell the encrypted cache in an online auction. The hackers said they had published the password as a "protest" about US President Donald Trump. Microsoft said on Friday its engineers had added detection and protection against the malware. The company was providing assistance to customers, it added.

Accidental hero temporarily halts its spread

A UK-based cyber-security researcher, tweeting as @MalwareTechBlog, said he had accidentally managed to temporarily halt the spread of the virus. He said that he noticed that the virus was searching for a web address that had not been registered. He bought the domain name for around $10 and found that by registering it, he triggered a "kill switch" that stopped the worm's spread. But, he warned it was likely to be only a temporary fix. 
"So long as the domain isn't removed, this particular strain will no longer cause harm, but patch your systems ASAP as they will try again," he tweeted.

UK NHS bosses and the government are facing questions over why hospitals had been left vulnerable to the global cyber-attack that crippled services on Friday. The health service faces a weekend of chaos after hackers demanding a ransom infiltrated the health service’s antiquated computer system.Operations and appointments were cancelled and ambulances diverted as up to 40 hospital trusts became infected by a “ransomware” attack demanding payment to regain access to vital medical records. Doctors warned that the infiltration, the largest cyber-attack in NHS history, could cost lives.

Biggest Ransomware Attack in History

Researchers with security software maker Avast said they had observed 57,000 infections in 99 countries with Russia, Ukraine and Taiwan the top targets.

Mikko Hypponen, chief research officer at the Helsinki-based cybersecurity company F-Secure, called the attack "the biggest ransomware outbreak in history".

The NHS said there was no evidence that patients’ medical records had been accessed, but it was unable to say whether the hackers, who are threatening to delete information unless payment is received within a week, had the ability to destroy such records.

Experts at GCHQ’s national cyber security centre were helping NHS teams fight the attack. The US Department of Homeland Security said late on Friday that it was aware of reports of the ransomware, was sharing information with domestic and foreign partners and was ready to lend technical support.

The attack has been declared a major incident, and has spread to Scotland, where crisis meetings were also being held.
A computer hacking group known as Shadow Brokers was at least partly responsible. It is claimed the group, which has links to Russia, stole US National Security Agency cyber tools designed to access Microsoft Windows systems, then dumped the technology on a publicly-accessible website where online criminals could access it, possibly in retaliation for America’s attack on Syria.

BBC:          Telegraph:

You Might Also Read:

Shadow Brokers Release Secret List Of NSA-Compromised Servers:

Stolen NSA Hacking Tools For Sale In Bizarre Auction:

Leak Spotlights NSA's Conflicting Missions:

UK’s New National Cyber Security Centre:

 

« Cyber Spies Go Mainstream
Darktrace Forms Cybersecurity Partnership With Siemens »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Itaccel

Itaccel

IT Accel began a decade ago as a band of technical recruiters who wanted to bring our experience and depth of knowledge to solving complex human resou

National Security Authority (NBU) - Slovakia

National Security Authority (NBU) - Slovakia

The National Security Authority (NBU) is the central government body in Slovakia for the Protection of Classified Information, Cryptographic Services, Trust Services and Cyber Security.

Haventec

Haventec

Haventec’s internationally patented technologies reduce cyber risk and enable pervasive trust services with a decentralised approach to authentication.

Swedish Board for Accreditation and Conformity Assessment (SWEDAC)

Swedish Board for Accreditation and Conformity Assessment (SWEDAC)

SWEDAC is the national accreditation body for Sweden. The directory of members provides details of organisations offering certification services for ISO 27001.

Stratus Cyber

Stratus Cyber

Stratus Cyber is a premier Cyber Security company specializing in Managed Security Services. Our services include Blockchain Security, Pentesting, and Compliance Assessments.

Sum&Substance (Sumsub)

Sum&Substance (Sumsub)

Sum&Substance is a developer of remote verification solutions. Our technology allows online services around the world to meet regulatory requirements, prevent fraud and enhance customer confidence.

Cobalt Iron

Cobalt Iron

Cobalt Iron is a global leader in SaaS-based enterprise backup and data protection technology.

Hold Security

Hold Security

Hold Security works with companies of all sizes to provide unparalleled Threat Intelligence services that actually make a difference.

Qohash

Qohash

With a focus on data security, Qohash supports security, compliance and optimization use cases enhancing your risk management process.

vCISO Services

vCISO Services

vCISO Services is a small, specialized, veteran-owned firm focused on the needs of SMBs only.

8com

8com

8com is an established Managed Security Service Provider (MSSP) with over 75 employees and customers in over 40 countries.

Probity

Probity

Probity Inc. is a certified software development and systems engineering company, providing support to federal government and national defense related clients.

Endor Labs

Endor Labs

Endor Labs gives developers and security teams the context they need to prioritize open source risk.

Summit 7 (S7)

Summit 7 (S7)

Summit 7 is a national leader in cybersecurity, compliance, and managed services for the Aerospace and Defense industry and corporate enterprises.

CBIT Digital Forensics Services (CDFS)

CBIT Digital Forensics Services (CDFS)

CDFS is Australia’s premier supplier of digital forensic tools, industry-embedded training and certification to Law Enforcement, Government, and Corporate Enterprise.

PrimeSSL

PrimeSSL

PrimeSSL, a leading Certificate Authority (CA) backed by the trusted Sectigo Root, delivers affordable and user-friendly SSL/TLS certificate solutions.