Tens of thousands of ransomware attacks have targeted organizations around the world. Security firm Kaspersky Lab recorded more than 45,000 attacks in 74 countries on Friday, including the UK, Spain, China and Russia.
The ransomware, called “WannaCry,” locks down all the files on an infected computer and asks the computer’s administrator to pay $300 or more within hours in order to regain control of them. There were reports of the ransomware affecting hospitals in the UK, Spanish telecom company Telefonica and a university in China.
British hospitals and clinics were forced to turn away patients because their computers were infected by “ransomware” that rapidly spread across the globe, demanding payments of as much as $600 to restore access and scrambling data.
Leading international shipper FedEx Corp was among the companies whose Microsoft Corp Windows systems were affected.
“Like many other companies, FedEx is experiencing interference with some of our Windows-based systems caused by malware,” a spokeswoman said in a statement. “We are implementing remediation steps as quickly as possible.”
Telecommunications company Telefonica was among many targets in Spain, though it said the attack was limited to some computers on an internal network and had not affected clients or services. Portugal Telecom and Telefonica Argentina both said they were also targeted in the attacks.
Private security firms identified the ransomware as a new variant of “WannaCry” that had the ability to automatically spread across large networks by exploiting a known bug in Microsoft’s Windows operating system.
“Once it gets in and starts moving across the infrastructure, there is no way to stop it,” said Adam Meyers, a researcher with cyber security firm CrowdStrike.
The hackers, who have not come forward to claim responsibility or otherwise been identified, likely made it a “worm,” or self spreading malware, by exploiting a piece of NSA code known as “Eternal Blue” that was released last month by a group known as the Shadow Brokers, researchers with several private cyber security firms said.
“This is one of the largest global ransomware attacks the cyber community has ever seen,” said Rich Barger, director of threat research with Splunk, one of the firms that linked WannaCry to the NSA.
The Shadow Brokers released Eternal Blue as part of a trove of hacking tools that they said belonged to the U.S. spy agency.
Microsoft on Friday said it was pushing out automatic Windows updates to defend clients from WannaCry. It issued a patch on March 14 to protect them from Eternal Blue.
“Today our engineers added detection and protection against new malicious software known as Ransom:Win32.WannaCrypt,” a Microsoft spokesman said in a statement. It said the company was working with its customers to provide additional assistance.
The spread of the ransomware capped a week of cyber turmoil in Europe that kicked off a week earlier when hackers posted a huge trove of campaign documents tied to French candidate Emmanuel Macron just 1-1/2 days before a run-off vote in which he was elected as the new president of France
On Wednesday hackers disputed the websites of several French media companies and aerospace giant Airbus.The hack also happened four weeks before a British parliamentary election in which national security and the management of the state-run National Health Service (NHS) are important campaign themes.
Authorities in Britain have been braced for possible cyberattacks in the run-up to the vote, as happened during last year’s U.S. election and on the eve of this month’s presidential vote in France.
But those attacks – blamed on Russia, which has repeatedly denied them – followed an entirely different modus operandi involving penetrating the accounts of individuals and political organizations and then releasing hacked material online.
On Friday, around 1,000 computers at the Russian Interior Ministry were affected by the cyberattack, a spokeswoman for the ministry told Interfax. – Reuters.
