Fast-moving cyber attacks wreak havoc worldwide
LONDON, May 13 (REUTERS) - A global cyber attack leveraging hacking tools believed to have been developed by the U.S. National Security Agency has infected tens of thousands of computers in nearly 100 countries, disrupting Britain's health system and global shipper FedEx. Cyber extortionists tricked victims into opening malicious malware attachments to spam emails that appeared to contain invoices, job offers, security warnings and other legitimate files.
The ransomware encrypted data on the computers, demanding payments of $ 300 to $ 600 to restore access. Security researchers said they observed some victims paying via the digital currency bitcoin, though they did not know what percent had given in to the extortionists.
Researchers with security software maker Avast said they had observed 57,000 infections in 99 countries, with Russia, Ukraine and Taiwan the top targets.
Asian countries reported no major breaches on Saturday, but officials in the region were scrambling to check and the full extent of the damage may not be known for some time. China's official Xinhua news agency said some secondary schools and universities had been affected, without specifying how many or identifying them.
The most disruptive attacks were reported in Britain, where hospitals and clinics were forced to turn away patients after losing access to computers on Friday.
International shipper FedEx Corp said some of its Windows computers were also infected.
Only a small number of US-headquartered organisations were hit because the hackers appear to have begun the campaign by targeting organisations in Europe, said Vikram Thakur, research manager with security software maker Symantec.
By the time they turned their attention to the United States, spam filters had identified the new threat and flagged the ransomware- laden emails as malicious, Thakur added.
Infections of the worm appeared to have fallen off significantly after a security researcher bought a domain that the malware was connecting to, by chance undermining the malware's effectiveness. Making the domain active appears to have stunted the spread of the worm, Thakur said on Saturday.
The US Department of Homeland Security said late on Friday it was aware of reports of the ransomware, was sharing information with domestic and foreign partners and was ready to lend technical support.
Private security firms identified the ransomware as a new variant of “WannaCry” that had the ability to automatically spread across large networks by exploiting a known bug in Microsoft's Windows operating system.
The hackers, who have not come forward to claim responsibility or otherwise been identified, likely made it a “worm”, or self spreading malware, by exploiting a piece of NSA code known as “Eternal Blue” that was released last month by a group known as the Shadow Brokers, researchers with several private cyber security firms said.