LONDON/MADRID: A global cyber attack leveraging hacking tools believed to have been developed by the US National Security Agency has infected tens of thousands of computers in nearly 100 countries, disrupting Britain’s health system and global shipper FedEx.
Cyber extortionists tricked victims into opening malicious malware attachments to spam emails that appeared to contain invoices, job offers, security warnings and other legitimate files. The ransomware encrypted data on the computers, demanding payments of 300 dollars to 600 dollars to restore access.
Security researchers said they observed some victims paying via the digital currency bitcoin, though they did not know what percent had given in to the extortionists.
Researchers with security software maker Avast said they had observed 57,000 infections in 99 countries, with Russia, Ukraine and Taiwan the top targets. Asian countries reported no major breaches on Saturday, but officials in the region were scrambling to check and the full extent of the damage may not be known for some time.
China’s official Xinhua news agency said some secondary schools and universities had
been affected, without specifying how many or identifying them. The most disruptive attacks were reported in Britain, where hospitals and clinics were forced to turn away patients after losing access to computers on Friday. International shipper FedEx Corp said some of its Windows computers were also infected. “We are implementing remediation steps as quickly as possible,” it said in a statement.
Only a small number of US-headquartered organizations were hit because the hackers appear to have begun the campaign by targeting organizations in Europe, said Vikram Thakur, research manager with security software maker Symantec.
By the time they turned their attention to the United States, spam filters had identified the new threat and flagged the ransomware-laden emails as malicious, Thakur added.
Infections of the worm appeared to have fallen off significantly after a security researcher bought a domain that the malware was connecting to, by chance undermining the malware’s effectiveness.
he spread of the ransomware capped a week of cyber turmoil in Europe that began the previous week when hackers posted a trove of campaign documents tied to French candidate Emmanuel Macron just before a run-off vote in which he was elected president of France. On Wednesday, hackers disrupted the websites of several French media companies and aerospace giant Airbus. Also, the hack happened four weeks before a British general election in which national security and the management of the state-run National Health Service (NHS) are important issues.
Authorities in Britain have been braced for cyber attacks in the run-up to the vote, as happened during last year’s US election and on the eve of the French vote. But those attacks – blamed on Russia, which has repeatedly denied them – followed a different modus operandi involving penetrating the accounts of individuals and political organisations and then releasing hacked material online.
Yesterday, Russia’s interior and emergencies ministries, as well as its biggest bank, Sberbank, said they were targeted. The interior ministry said on its website that about 1,000 computers had been infected but it had localized the virus. The emergencies ministry told Russian news agencies it had repelled the cyber attacks while Sberbank said its cyber security systems had prevented viruses from entering its systems.
NEW BREED OF RANSOMWARE
Although cyber extortion cases have been rising for several years, they have to date affected small-to-mid sized organisations, disrupting services provided by hospitals, police departments, public transport systems and utilities in the United States and Europe. “Seeing a large telco like Telefonica get hit is going to get everybody worried.
Now ransomware is affecting larger companies with more sophisticated security operations,” said Chris Wysopal, chief technology officer with cyber security firm Veracode.
The news is also likely to embolden extortionists when selecting targets, Chris Camacho, chief strategy officer with cyber intelligence firm Flashpoint, said. In Spain, some big firms took pre-emptive steps to thwart ransomware attacks following a warning from the National Cryptology Centre of “a massive ransomware attack”.
Iberdrola and Gas Natural, along with Vodafone’s unit in Spain, asked staff to turn off computers or cut off internet access in case they had been compromised, representatives from the firms said. The attacks did not disrupt the provision of services or networks operations of the victims, the Spanish government said in a statement.
Follow our WhatsApp channel
