Ransomware infections reported worldwide
Ransomware infections reported worldwide
By Chris Baraniuk May 12, 2017
A massive ransomware campaign appears to have infected a
number of organisations around the world.
Computers in thousands of locations have apparently been
locked by a program that demands $300 (£230) in Bitcoin.
There have been reports of infections in as many as 74
countries, including the UK, US, China, Russia, Spain, Italy and Taiwan.
Many security researchers are linking the incidents
together.
One cyber-security researcher tweeted that he had
detected many thousands of cases of the ransomware, known as WannaCry and
variants of that name.
"This is huge," said Jakub Kroustek at Avast.
Another, at cyber-security firm Kaspersky, said that the
ransomware had been spotted cropping up in 74 countries and that the number was
still growing.
Several experts monitoring the situation have linked the
infections to vulnerabilities released by a group known as The Shadow Brokers,
which recently claimed to have dumped hacking tools stolen from the US National
Security Agency (NSA).
A patch for the vulnerability was released by Microsoft
in March, but many systems may not have had the update installed.
Some security researchers have pointed out that the
infections seem to be deployed via a worm - a program that spreads by itself
between computers.
The UK's National Health Service (NHS) was also hit by a
ransomware outbreak on the same day and screenshots of the WannaCry program
were shared by NHS staff.
A number of Spanish firms were among the apparent victims
elsewhere in Europe.
Telecoms giant Telefonica said in a statement that it was
aware of a "cybersecurity incident" but that clients and services had
not been affected.
Power firm Iberdrola and utility provider Gas Natural
were also reported to have suffered from the outbreak.
There were reports that staff at the firms were told to
turn off their computers.
Screenshots of WannaCry with text in Spanish were also
shared online.
In Italy, one user shared images appearing to show a
university computer lab with machines locked by the same program.
Bitcoin wallets seemingly associated with the ransomware
were reported to have already started filling up with cash.
'Spreading fast'
Another firm that confirmed it had been caught out was
delivery company FedEx, though it did not clarify in which territories it had
been hit.
"Like many other companies, FedEx is experiencing
interference with some of our Windows-based systems caused by malware," it
said in a statement.
"We are implementing remediation steps as quickly as
possible."
And Portugal Telecom also confirmed it was struck:
"But none of our services were affected," a spokeswoman told the
Reuters news agency.
"This is a major cyber attack, impacting
organisations across Europe at a scale I've never seen before," said
security architect Kevin Beaumont.
According to security firm Check Point, the version of
the ransomware that appeared today is a new variant.
"Even so, it's spreading fast," said Aatish
Pattni, head of threat prevention for northern Europe.
Comments
Post a Comment