A security researcher may have helped stop the spread of the ransomware, which hit tens of thousands of PCs worldwide

Friday’s unprecedented ransomware attack may have stopped spreading to new machines -- at least briefly -- thanks to a "kill switch" that a security researcher has activated.

The ransomware, called Wana Decryptor or WannaCry, has been found infecting machines across the globe. It works by exploiting a Windows vulnerability that the U.S. National Security Agency may have used for spying.

The malware encrypts data on a PC and shows users a note demanding $300 in bitcoin to have their data decrypted. Images of the ransom note have been circulating on Twitter. Security experts have detected tens of thousands of attacks, apparently spreading over LANs and the internet like a computer worm.

However, the ransomware also contains a kill switch that may have backfired on its developers, according to security researchers.

Wana Decryptor infects systems through a malicious program that first tries to connect to an unregistered web domain. The kill switch appears to work like this: If the malicious program can’t connect to the domain, it’ll proceed with the infection. If the connection succeeds, the program will stop the attack.

A security researcher who goes by the name MalwareTech found that he could activate the kill switch by registering the web domain and posting a page on it.

MalwareTech's original intention was to track the ransomware's spread through the domain it was contacting. “It came to light that a side effect of us registering the domain stopped the spread of the infection,” he said in an email.

Security firm Malwarebytes and Cisco’s Talos security group reported the same findings and said new ransomware infections appear to have slowed since the kill switch was activated.

However, Malwarebytes researcher Jerome Segura said it’s too early to tell whether the kill switch will stop the Wana Decryptor attack for good. He warned that other versions of the same ransomware strain may be out there that have fixed the kill-switch problem or are configured to contact another web domain.

Unfortunately, computers already infected with Wana Decryptor will remain infected, he said.

Friday’s ransomware attack first spread through a massive email phishing campaign. At least some of those emails appeared to be messages from a bank about a money transfer, according to Cisco’s Talos group.

Victims who opened the attachment in the email were served with the ransomware, which takes over the computer, security researchers said.

The Wana Decryptor itself is no different from other typical ransomware strains. Once it infects the PC, it’ll encrypt all the files on the machine, and then demand the victim pay a ransom to free them. </s> Friday’s unprecedented ransomware attack may have stopped spreading to new machines -- at least briefly -- thanks to a "kill switch" that a security researcher has activated.

The ransomware, called Wana Decryptor or WannaCry, has been found infecting machines across the globe. It works by exploiting a Windows vulnerability that the U.S. National Security Agency may have used for spying.

The malware encrypts data on a PC and shows users a note demanding $300 in bitcoin to have their data decrypted. Images of the ransom note have been circulating on Twitter. Security experts have detected tens of thousands of attacks, apparently spreading over LANs and the internet like a computer worm.

However, the ransomware also contains a kill switch that may have backfired on its developers, according to security researchers.

Wana Decryptor infects systems through a malicious program that first tries to connect to an unregistered web domain. The kill switch appears to work like this: If the malicious program can’t connect to the domain, it’ll proceed with the infection. If the connection succeeds, the program will stop the attack.

A security researcher who goes by the name MalwareTech found that he could activate the kill switch by registering the web domain and posting a page on it.

MalwareTech's original intention was to track the ransomware's spread through the domain it was contacting. “It came to light that a side effect of us registering the domain stopped the spread of the infection,” he said in an email.

Security firm Malwarebytes and Cisco’s Talos security group reported the same findings and said new ransomware infections appear to have slowed since the kill switch was activated.

However, Malwarebytes researcher Jerome Segura said it’s too early to tell whether the kill switch will stop the Wana Decryptor attack for good. He warned that other versions of the same ransomware strain may be out there that have fixed the kill-switch problem or are configured to contact another web domain.

Unfortunately, computers already infected with Wana Decryptor will remain infected, he said.

Friday’s ransomware attack first spread through a massive email phishing campaign. At least some of those emails appeared to be messages from a bank about a money transfer, according to Cisco’s Talos group.

Victims who opened the attachment in the email were served with the ransomware, which takes over the computer, security researchers said.

The Wana Decryptor itself is no different from other typical ransomware strains. Once it infects the PC, it’ll encrypt all the files on the machine, and then demand the victim pay a ransom to free them.

But unlike other ransomware, Wana Decryptor has been built to spread quickly. It does so by incorporating a hacking tool that security researchers suspect came from the NSA and was leaked online last month.

The hacking tool, dubbed EternalBlue, can make it easy to hijack unpatched older Windows machines. Once Wana Decryptor has infected the first machine, it’ll attempt to spread to other machines on the same local network. Then it will scan the internet for vulnerable machines.

“It creates a snowball-like effect,” Segura said. “A few machines will be infected, then it’ll try to contact more.”

Security firm Avast said it had detected more than 75,000 attacks in 99 countries, with Russia, Ukraine and Taiwan among the hardest-hit countries. The U.K.’s National Health Service was one of the biggest organizations hit by the ransomware.

The ransomware was designed to work in numerous languages, including English, Chinese and Spanish, with ransom notes in each.

Segura advised victims not to pay the ransom because it encourages the hackers. Instead, he says they should wait for next few days as security researchers study the ransomware’s coding and try to come up with free ways to solve the infection.

On Friday, Microsoft said users will be protected from the ransomware if they’re running the company’s free antivirus software or have installed the latest patches. </s> London — The cyber attack that spread malicious software around the world, shutting down networks at hospitals, banks and government agencies, was thwarted by a young British researcher and an inexpensive domain registration, with help from another 20-something security engineer in the US.

Britain's National Cyber Security Center and others were hailing the cyber security researcher, a 22-year-old identified online only as MalwareTech, who — unintentionally at first — discovered a so-called "kill switch" that halted the unprecedented outbreak.

By then the "ransomware" attack had crippled Britain's hospital network and computer systems in several countries in an effort to extort money from computer users. But the researcher's actions may have saved companies and governments millions of dollars and slowed the outbreak before computers in the US were more widely affected.

MalwareTech is part of a large global cyber security community, working independently or for security companies, who are constantly watching for attacks and working together to stop or prevent them, often sharing information via Twitter. It's not uncommon for them to use aliases, either to protect themselves from retaliatory attacks or for privacy.

In a blog post on Saturday, MalwareTech explained he returned from lunch with a friend on Friday and learned that networks across Britain's health system had been hit by ransomware, tipping him off that "this was something big".

He began analysing a sample of the malicious software and noticed its code included a hidden web address that wasn't registered. He said he "promptly" registered the domain, something he regularly does to try to discover ways to track or stop malicious software.

Across an ocean, Darien Huss, a 28-year-old research engineer for the cyber security firm Proofpoint, was doing his own analysis. The western Michigan resident said he noticed the authors of the malware had left in a feature known as a kill switch. Huss took a screen shot of his discovery and shared it on Twitter.

Soon he and MalwareTech were communicating about what they'd found: That registering the domain name and redirecting the attacks to MalwareTech's server had activated the kill switch, halting the ransomware's infections.

Huss and others were calling MalwareTech a hero on Saturday, with Huss adding that the global cyber security community was working "as a team" to stop the infections from spreading.

"I think the security industry as a whole should be considered heroes," he said.

But he also said he's concerned the authors of the malware could re-release it without a kill switch or with a better one, or that copycats could mimic the attack.

"I think it is concerning that we could definitely see a similar attack occur, maybe in the next 24 to 48 hours or maybe in the next week or two," Huss said. "It could be very possible."

Who perpetrated this wave of attacks remains unknown. Two security firms — Kaspersky Lab and Avast — said they identified the malicious software in more than 70 countries. Both said Russia was hit hardest.

These hackers "have caused enormous amounts of disruption— probably the biggest ransomware cyber attack in history," said Graham Cluley, a veteran of the anti-virus industry in Oxford, England.

This is already believed to be the biggest online extortion attack ever recorded, disrupting services in nations as diverse as the US, Russia, Ukraine, Brazil, Spain and India. Europol, the European Union's police agency, said the onslaught was at "an unprecedented level and will require a complex international investigation to identify the culprits."

In Russia, government agencies insisted that all attacks had been resolved. Russian Interior Ministry, which runs the national police, said the problem had been "localised" with no information compromised. Russia's health ministry said its attacks were "effectively repelled."

The ransomware exploits a vulnerability in Microsoft Windows that was purportedly identified by the US National Security Agency for its own intelligence-gathering purposes. Hackers said they stole the tools from the NSA and dumped them on the internet. </s> Update — After reading this article, if you want to know, what has happened so far in past 4 days and how to protect your computers from WannaCry, read our latest article "WannaCry Ransomware: Everything You Need To Know Immediately." After reading this article, if you want to know, what has happened so far in past 4 days and how to protect your computers from WannaCry, read our latest article "

"If NSA had privately disclosed the flaw used to attack hospitals when they *found* it, not when they lost it, this may not have happened," NSA whistleblower Edward Snowden says.

Kill-Switch for WannaCry? No, It's not over yet!

hxxp://www[.]iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com

hxxp://ifferfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com/

Since the kill-switch feature was in the SMB worm, not in the ransomware module itself., "WannaCrypt ransomware was spread normally long before this and will be long after, what we stopped was the SMB worm variant," MalwareTech told The Hacker News.

If you receive WannaCry via an email, a malicious torrent, or other vectors (instead of SMB protocol).

If by chance your ISP or antivirus or firewall blocks access to the sinkhole domain.

If the targeted system requires a proxy to access the Internet, which is a common practice in the majority of corporate networks.

If someone makes the sinkhole domain inaccessible for all, such as by using a large-scale DDoS attack.

WannaCry 2.0, Ransomware With *NO* Kill-Switch Is On Hunt!

CIRCL c/o securitymadein.lu

"I can confirm we've had versions without the kill switch domain connect since yesterday," told The Hacker News.

Updated: WannaCry 2.0 is Someone Else's Work

"The patched version matt described does attempt to spread. It's a full set which was modified by someone with a hex editor to disable the kill switch," Raiu told me.

"Given the high profile of the original attack, it's going to be no surprise at all to see copycat attacks from others, and perhaps other attempts to infect even more computers from the original WannaCry gang. The message is simple: Patch your computers, harden your defences, run a decent anti-virus, and - for goodness sake - ensure that you have secure backups." Cyber security expert Graham Cluley told The Hacker News.

"The next attacks are inevitable, you can simply patch the existing samples with a hex editor and it'll continue to spread," Matthew Hickey, a security expert and co-founder of Hacker House told me.

"We will see a number of variants of this attack over the coming weeks and months so it's important to patch hosts. The worm can be modified to spread other payloads not just WCry and we may see other malware campaigns piggybacking off this samples success."

"The worm functionality attempts to infect unpatched Windows machines in the local network. At the same time, it also executes massive scanning on Internet IP addresses to find and infect other vulnerable computers. This activity results in large SMB traffic from the infected host," Microsoft says.

Video Demo of WannaCry Ransomware Infection



And Second one…

Get Prepared: Upgrade, Patch OS & Disable SMBv1

WannaCry has Hit Over 200,000 Systems in 150 Countries, Warned Europol

"We are running around 200 global operations against cyber crime each year, but we've never seen anything like this," Wainwright said, as quoted by BBC.

"The latest count is over 200,000 victims in at least 150 countries. Many of those victims will be businesses, including large corporations. The global reach is unprecedented."

If you are following the news, by now you might be aware that a security researcher has activated a "Kill Switch" which apparently stopped the WannaCry ransomware from spreading further.But it's not true, neither the threat is over yet.However, the kill switch has just slowed down the infection rate.Multiple security researchers have claimed that there are more samples of WannaCry out there, with different 'kill-switch' domains and without any kill-switch function, continuing to infect unpatched computers worldwide (find more details below).So far, over 237,000 computers across 99 countries around the world have been infected, and the infection is still rising even hours after the kill switch was triggered by the 22-years-old British security researcher behind the twitter handle ' MalwareTech .'For those unaware, WannaCry is an insanely fast-spreading ransomware malware that leverages a Windows SMB exploit to remotely target a computer running on unpatched or unsupported versions of Windows.Once infected, WannaCry also scans for other vulnerable computers connected to the same network, as well scans random hosts on the wider Internet, to spread quickly.The SMB exploit, currently being used by WannaCry, has been identified as EternalBlue, a collection of hacking tools allegedly created by the NSA and then subsequently dumped by a hacking group calling itself " The Shadow Brokers " over a month ago.In our previous two articles , we have put together more information about this massive ransomware campaign, explaining how MalwareTech accidentally halted the global spread of WannaCry by registering a domain name hidden in the malware.The above-mentioned domain is responsible for keeping WannaCry propagating and spreading like a worm, as I previously explained that if the connection to this domain fails, the SMB worm proceeds to infect the system.Fortunately, MalwareTech registered this domain in question and created a sinkhole – tactic researchers use to redirect traffic from the infected machines to a self-controlled system. (Matthieu Suiche, a security researcher, has confirmed that he has found a new WannaCry variant with a different domain for kill-switch function, which he registered to redirect it to a sinkhole in an effort to slows down the infections.The newly discovered WannaCry variant works exactly like the previous variant that wreaked havoc across the world Friday night.But, if you are thinking that activating the kill switch has completely stopped the infection, then you are mistaken.You should know that the kill-switch would not prevent your unpatched PC from getting infected, in the following scenarios:MalwareTech also confirmed THN that some "Mirai botnet skids tried to DDoS the [sinkhole] server for lulz," in order to make it unavailable for WannaCry SMB exploit, which triggers infection if the connection fails. But "it failed hardcore," at least for now.Initially, this part of story was based on research of a security researcher, who earlier claimed to have the samples of new WannaCry ransomware that comes with no kill-switch function. But for some reason, he backed off. So, we have removed his references from this story for now.However, shortly after that, we were confirmed by Costin Raiu , the director of global research and analysis team at Kaspersky Labs, that his team had seen more WannaCry samples on Friday that did not have the kill switch.Raiu from Kaspersky shared some samples, his team discovered, with Suiche, who analysed them and just confirmed that there is a WannaCrypt variant without kill switch, and equipped with SMB exploit that would help it to spread rapidly without disruption.What's even worse is that the new WannaCry variant without a kill-switch believed to be created by someone else, and not the hackers behind the initial WannaCry ransomware.However, Suiche also confirmed that the modified variant with no kill switch is corrupted, but this doesn't mean that other hackers and criminals would not come up with a working one.Expect a new wave of ransomware attack, by initial attackers and new ones, which would be difficult to stop, until and unless all vulnerable systems get patched.Even after WannaCry attacks made headlines all over the Internet and Media, there are still hundreds of thousands of unpatched systems out there that are open to the Internet and vulnerable to hacking.Believe me, the new strain of WannaCry 2.0 malware would not take enough time to take over another hundred of thousand vulnerable systems.Hickey has also provided us two video demonstrations, showing packet traces that confirm the use of Windows SMB vulnerability (MS17-010).Since WannaCry is a single executable file, it can also be spread through other regular exploit vectors, such as spear phishing, drive-by-download attack, and malicious torrent files download, warned Hickey.MalwareTech also warned of the future threat, saying"Informed NCSC, FBI, etc. I've done as much as I can do currently, it's up to everyone to patch," he added.As we notified today, Microsoft took an unusual step to protect its customers with an unsupported version of Windows — including Windows XP, Vista, Windows 8, Server 2003 and 2008 — by releasing security patches that fix SMB flaw currently being exploited by the WannaCry ransomware.Even after this, I believe, many individuals remain unaware of the new patches and many organizations, as well as embedded machines like ATM and digital billboard displays, running on older or unpatched versions of Windows, who are considering to upgrade their operating system, would take time as well as it’s going to cost them money for getting new licenses.So, users and organizations are strongly advised to install available Windows patches as soon as possible, and also consider disabling SMBv1 ( follow these steps ), to prevent similar future cyber attacks.Apply Patches. Microsoft has been very generous to you.Almost all antivirus vendors have already been added signatures to protect against this latest threat. Make sure you are using a good antivirus, and keep it always up-to-date.Moreover, you can also follow some basic security practices I have listed to protect yourself from such malware threats.Speaking to Britain's ITV, Europol chief Rob Wainwright said the whole world is facing an "escalating threat," warning people that the numbers are going up and that they should ensure the security of their systems is up to date.Above map is showing the WannaCry ransomware infection in just 24 hours.This story is still updating, stay tuned to our Twitter page for more up-to-date information. </s> Hong Kong: A cyber-security researcher appears to have discovered a "kill switch" that can prevent the spread of the WannaCry ransomware, for now, that has caused the cyberattacks wreaking havoc globally.

The researcher, tweeting as @MalwareTechBlog, said the discovery was accidental, but that registering a domain name used by the malware stops it from spreading.

"Essentially they relied on a domain not being registered and by registering it, we stopped their malware spreading," @MalwareTechBlog told AFP in a private message on Twitter.

 The researcher warned however that people "need to update their systems ASAP" to avoid attack.

"The crisis isn't over, they can always change the code and try again," @MalwareTechBlog said.

Friday's wave of cyberattacks, which affected dozens of countries, apparently exploited a flaw exposed in documents leaked from the US National Security Agency.

The attacks used a technique known as ransomware that locks users' files unless they pay the attackers a designated sum in the virtual currency Bitcoin.

Affected by the onslaught were computer networks at hospitals in Britain, Russia's interior ministry, the Spanish telecom giant Telefonica and the US delivery firm FedEx and many other organisations.

French carmaker Renault also announced it was attacked. A spokeswoman said the company was "doing what is needed to counter this attack."

"I will confess that I was unaware registering the domain would stop the malware until after I registered it, so initially it was accidental," @MalwareTechBlog tweeted.

Unfortunately however, computers already affected will not be helped by the solution. "So long as the domain isn't revoked, this particular strain will no longer cause harm, but patch your systems ASAP as they will try again."

The malware's name is WCry, but analysts were also using variants such as WannaCry.

Forcepoint Security Labs said in a Friday statement that the attack had "global scope" and was affecting networks in Australia, Belgium, France, Germany, Italy and Mexico. In the United States, FedEx acknowledged it had been hit by malware and was "implementing remediation steps as quickly as possible."

Also badly hit was Britain's National Health Service, which declared a "major incident" after the attack, which forced some hospitals to divert ambulances and scrap operations. Pictures posted on social media showed screens of NHS computers with images demanding payment of USD 300 (275 euros) in Bitcoin, saying: "Ooops, your files have been encrypted!"

It demands payment in three days or the price is doubled, and if none is received in seven days, the files will be deleted, according to the screen message.

A hacking group called Shadow Brokers released the malware in April claiming to have discovered the flaw from the NSA, according to Kaspersky Lab, a Russian cybersecurity provider.

Kaspersky researcher Costin Raiu cited 45,000 attacks in 74 countries as of Friday evening. </s> As the world readies to open for business on Monday, companies and governments are bracing for a second round of cyberattacks in the aftermath of Friday’s WannaCry hack.

Indeed, security experts are already warning that a new version of WannaCry has emerged over the weekend that doesn’t have the kill switch protocol that stopped the initial version of the cyberattack late on Friday.

Earlier today, the U.K.’s National Cyber Security Center issued a new warning about the possibility of another attack.

Since the global coordinated ransomware attack on thousands of private and public sector organisations across dozens of countries on Friday, there have been no sustained new attacks of that kind. But it is important to understand that the way these attacks work means that compromises of machines and networks that have already occurred may not yet have been detected, and that existing infections from the malware can spread within networks. This means that as a new working week begins it is likely, in the UK and elsewhere, that further cases of ransomware may come to light, possibly at a significant scale.

By the end of the workday on Friday, when the initial version of the WannaCry hack was detected, hundreds of thousands of computers were affected.

Past 24 hours #WannaCry infection map. What a bloodbath. pic.twitter.com/k5QvK2N0pu — Patrick Schanen (@patrickschanen) May 14, 2017

When workers in Asia wake up on Monday morning, security experts expect another wave of computers to be exposed to the ransomware attack.

The New York Times reported that some security industry observers are saying that the second wave of attacks has already begun.

Writing on his blog, Matt Suiche, the founder of Comae Technologies, elaborated on some of the new variants of the ransomware that cybersecurity specialists are finding in the wild.

Today (14 May 2017), 2 new variants appeared. One working which I blocked by registering the new domain name, and the second which is only partially working because it only spreads and does *not* encrypt files due to a corrupted archive. A new variant had been caught by @benkow_ and sent to me for analysis. I reversed it and found a new kill-switch ( ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com ) which I immediately registered to stop the new wave of global attacks. Then, I synchronized with @MalwareTechBlog and @2sec4u to map the new domain to sinkhole name servers to feed the live interactive infection map. This is 32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf . A new variant with no kill-switch caught by Kaspersky. Although, this build does only work *partially* as the ransomware archive is corrupted — the spreading still works though. This is 07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd .

And the anonymous cybersecurity researcher who discovered the kill switch on the original malware attack has his own warning for system administrators.

Version 1 of WannaCrypt was stoppable but version 2.0 will likely remove the flaw. You're only safe if you patch ASAP. — MalwareTech (@MalwareTechBlog) May 14, 2017

By now, you’re likely aware that the original malware attack originated from leaked code developed by the National Security Administration. The attack worked by exploiting a flaw in Microsoft Windows. Although Microsoft had provided a patch for the software several months ago, not everyone updated their systems, which led to the vulnerabilities that the still-anonymous hackers exploited.

According to this Symantec explainer, the ransomware encrypts data files and asks users to pay a bitcoin ransom of $300, which doubles if payment isn’t made after three days. After a week, the encrypted files will be deleted.

Figure 1 Ransom demand screen displayed by WannaCry Trojan

If you’re curious how Ransomware attacks work, here’s a primer from security firm Carbon Black.

Companies affected by the attacks included the Spanish telecommunications company, Telefonica, Gas Natural and electricity provider Iberdrola. National Health Services hospitals in the UK were also affected by the attack. As was FedEx in the U.S. and Renault in France.

The attacks also hit Germany’s rail system, Russia’s Interior Ministry and universities around China, according to reports in The New York Times.

“It’s no surprise that over 45,000 targets across the globe were attacked by the WannaCry ransomware,” wrote Mark Kuhr, the co-founder and chief technology officer of the white hat penetration testing and bug bounty hunting startup Synack. “The frequency of these attacks will continue to rise exponentially because ransomware is such a lucrative business for criminal enterprises. A recent IBM survey of 1,000 business professionals found that 60% of victims are willing to pay ransom to get data back safely.”

Part of what makes these attacks so inevitable is the availability of these tools to almost anyone. Would-be hackers don’t even need to be that skilled to deploy these kinds of malware programs.

Thanks to groups like Shadow Brokers, which leaked the National Security Agency’s hacking tools, malware like the kind that seized systems around the globe are available to anyone with an internet connection. </s> (CNN) A massive global ransomware attack has struck hospitals, companies and government offices around the world, seizing control of affected computers until the victims pay a ransom.

The majority of the attacks targeted Russia, Ukraine and Taiwan. But the National Health Service in the United Kingdom and global firms such as FedEx also reported they had come under assault Friday. Experts suggested Saturday that the ransomware's progress had been halted, but new attacks could soon follow.

Here are five things to know:

It may not be over yet

Cybersecurity experts have been working around the clock to try to halt the malware attack that is unprecedented in scale.

The ransomware's progress has been halted by the accidental discovery late Friday of a "kill switch" hidden within the code by a security researcher, said cybersecurity consultant David Kennedy, formerly of the US National Security Agency.

"The software has actually stopped spreading across the world," he told CNN.

"He actually probably saved lives by accident," Kennedy said, referring to the security researcher who discovered the kill switch.

The ransomware was designed to repeatedly contact an unregistered domain listed in its code. The security researcher -- who uses the Twitter handle @MalwareTechBlog -- registered that domain to collect the ransomware traffic for analysis and to track infections.

However, a hacker could change the code to remove the domain and try the ransomware attack again.

Also, the kill switch won't help anyone whose computer was already infected. Individuals and companies still have to decide if they want to pay the ransom or part with their data.

Michael Gazeley, managing director of cybersecurity firm Network Box, told CNN that the danger is far from over and that a company's security patch on Saturday might not still work by Monday.

"A lot of people are going to go to work on Monday and click on a link in their mail -- completely oblivious that all of this is going on or have heard about it and think that it's over -- and suddenly wipe out their whole company," Gazeley said from Hong Kong.

"IT managers need to be extremely aware that new variants of this ransomware attack are being launched almost hourly, so they can't just check that their computer systems are protected, then relax, assuming everything will stay that way," he said.

Cybersecurity firm Avast said it tracked more than 75,000 ransomware attacks in 99 countries Friday.

European police agency Europol said it was working to support countries, saying the malware attack was at an "unprecedented level and requires international investigation."

The malware is spread by taking advantage of a Windows vulnerability that Microsoft released a security patch for in March. But computers and networks that didn't update their systems remained at risk.

Mikko Hypponen, chief research officer at cybersecurity company F-Secure in Helsinki, Finland, called it "the biggest ransomware outbreak in history," according to an online post.

The cyberattack affected 16 organizations that are part of the National Health Service on Friday, causing some surgical procedures to be canceled and ambulances diverted. But the NHS said Saturday it does not have any evidence that patient data was breached.

A senior nurse with NHS Lanarkshire in Scotland posted a video on Twitter appealing to members of the public "to stay away from acute hospitals unless it's an absolute emergency situation" while its IT systems remain affected.

Grant Gowers, 50, from Clacton-on-Sea in southern England, told CNN how the ransomware attack had directly affected him. Doctors told him two weeks ago they needed to schedule a prostate biopsy to determine if he has cancer.

But around 5 p.m. Friday he got a call to say his biopsy had been canceled as a result of the ransomware attack.

"I have built myself up for the last two weeks," he told CNN. "If I know I have cancer, I could deal with it."

His procedure is being rescheduled within the next two weeks. But that's not good enough for Gowers. "I really want to grab the person who done this today and give him a picture of how this is affecting my life," he said.

The UK government has called a meeting of its crisis response committee, known as Cobra, on Saturday to discuss the situation.

Here's what you should do

If your computer has been affected, there's no guarantee that paying the ransom will restore it, Gazeley said. In past ransomware attacks, some victims have paid, only to find the key they are given doesn't work, while others have found their files are corrupted and can't be properly restored, he said.

Managers at many companies and other organizations have not taken steps to put proper cybersecurity systems in place despite talking about their importance, Gazeley said. "Most organizations just keep their heads in the sand," he said.

No one has yet identified the culprit.

"We see all the finger-pointing at the usual suspects, saying it's probably people in Russia or China, but, to quote Sherlock Holmes, it's not really a good idea to guess without the evidence," Gazeley said. Bitcoin is set up to be untraceable, so investigators will struggle to follow a money trail, he said.

Nonetheless, authorities around the world will be seeking to track down those responsible.

"I think these hackers have to recognize that these authorities will come after them with a vengeance," Gazeley said.

It also may never be known how much the hackers have netted from the ransomware attack. Many firms are unlikely to want to reveal they fell victim to it and whether they paid up. </s> iStock/Thinkstock(NEW YORK) — Europe and Russia were left reeling Saturday by a malicious global cyberattack that used leaked NSA tools to exploit a vulnerability in Microsoft Windows and spread ransomware across networks around the world.

Tens of thousands of users from London to St. Petersburg logged on yesterday to find ominous threats to delete their suddenly encrypted computer files, unless they cough up $300 or more in Bitcoin payments to the unknown perpetrators, security experts and intelligence officials told ABC News Saturday.

A message saying “Oops, your important files are encrypted” flashed across screens all over the world. According to The New York Times, experts estimated that before the last affected computers are unlocked, victims could collectively pay more than $1 billion to the attackers.

The attack appears to have been thwarted by private cybersecurity researchers who identified and triggered the malware’s “kill switch,” which halted the attacks before it spread throughout U.S. networks, a senior U.S. intelligence official confirmed, but it is unclear whether, the official said, a modified attack will soon be launched.

“That is a huge concern right now,” said Darien Huss, a senior security research engineer at Proofpoint who was among the researchers who helped disable the virus, called “WannaCry,” told ABC News Saturday. “It would not be very difficult at all to re-release this ransomware attack without a kill switch or without an approved kill switch that only they can activate.”

Huss is also worried about copycats, who could “take the exploit code that was used in this attack and implement it into their own virus.”

The tally of victims so far includes FedEx in the United States, railroads in Germany and Russia, factories and phone companies across Europe. Among the worst impacted by the historic attack unprecedented in its breadth was Britain’s Public Health Service, where more than 45 facilities had to suspend operations and divert patients and surgeries.

“The impact on the U.S. seems to be negligible — very tiny impact, very few victims,” the senior intelligence official told ABC News Saturday, adding that there is “no attribution yet” to any individuals, groups or nation-states behind the attacks reported in more than 100 countries.

“It’s impacting overseas among those who have outdated software or pirated software,” the senior intelligence official said. “The U.S. government is better suited to react and respond to something like this than some other countries because of years of work between the private sector and the government.”

Cybersecurity experts believe the attack was carried out with the help of tools first developed by the U.S. National Security Agency for targeting terrorists and foreign adversaries, which was leaked to the public by a hacker group called The Shadow Brokers in April.

“They lost it, somebody stole the information published it on the internet, and now it’s being used against victims in the United States and elsewhere,” said John Bambenek of Fidelis Cybersecurity.

While Microsoft broadened access to a security patch on Saturday to thousands of users whose old Windows support agreements have expired, law enforcement and intelligence authorities around the world, led by Britain’s new cybersecurity agency, are working to track down whoever was responsible — with Russian organized crime considered a leading suspect, some experts said.

“The reason this is hitting so many computers at once is that they discovered a vulnerability in the most popular operating system in the world, in Microsoft windows,” said John Carlin, former assistant attorney general for national security and an ABC News contributor. “And they’re taking advantage of it. It’s one that Microsoft delivered a solution for, but a lot of people haven’t used it.”

As the attack spread to five continents, the damage was contained, for the moment, when a computer programmer in Great Britain says he stumbled upon the kill switch after Huss shared some of his work on social media. The researcher, who uses the pseudonym “MalwareTech” for personal security, registered a domain name buried in the code of the attack and was surprised to discover that it was the kill switch that sent a signal to stop the attacks.

“In this case, when we registered it, it turned out to be a kill switch,” Salim Neino, CEO of Kryptos Logic, which employs MalwareTech as a cybersecurity researcher, told ABC News. “We verified it and turned the information over to the FBI.”

The researcher behind “Malware Tech” sent the virus down a “sinkhole,” preventing it from spreading more widely.

“If malware tech had not sinkhole that domain as quickly as he had, we definitely could have seen many, many more infection that occurred,” Huss said. “Potentially hundreds of thousands and into the millions.”

While this attack has slowed, experts warn that networks remain vulnerable.

“This was a combination attack, obviously coordinated. We need to take the act of keeping our systems and devices up to date seriously,” said Tyler Cohen Wood, a former senior intelligence official involved in cyber operations. “Unfortunately, until this is taken more seriously, this massive wide scale type of attack is only the beginning.” </s> Amid a desperate situation on Friday in which hundred of thousands of ransomware attacks pelted computers in nearly 100 countries, one stroke of good fortune hit, too. As the malware analysis expert who calls himself MalwareTech rushed to examine the so-called WannaCry strain, he stumbled on a way to stop it from locking computers and slow its spread. All it took was ten bucks, and a little luck.

WannaCry swept Europe and Asia quickly yesterday, locking up critical systems like the UK’s National Health Service, a large telecom in Spain, and other businesses and institutions around the world, all in record time. Once infected, a victim’s computer denies access, and instead displays a message that demands the equivalent of around $300 in bitcoin.

While many thousands have had their lives impacted—including countless people in need of medical care in the UK—two things have slowed WannaCry’s spread. First, Microsoft released a rare emergency patch to help protect Windows XP devices from its reach. (The company hasn’t officially supported XP since 2014.) That helps the many aging systems with no security resource get ahead of infection, if they can download the patch before WannaCry hits. The other, though, was MalwareTech’s happy accident.

As he worked to reverse-engineer samples of WannaCry on Friday, MalwareTech discovered that the ransomware’s programmers had built it to check whether a certain gibberish URL led to a live web page. Curious why the ransomware would look for that domain, MalwareTech registered it himself. As it turns out, that $10.69 investment was enough to shut the whole thing down—for now, at least.

It turned out that as long as the domain was unregistered and inactive, the query had no effect on the ransomware’s spread. But once the ransomware checked the URL and found it active, it shut down.

There are competing theories as to why WannaCry’s perpetrators built it this way. One possibility: The functionality was put in place as an intentional kill switch, in case the creators ever wanted to rein in the monster they’d created. “Based on the behavior implemented in the code, the kill switch was most likely intentional,” says Darien Huss, senior security research engineer at the security intelligence firm Proofpoint, who was working on real-time WannaCry analysis and mitigation on Friday.

MalwareTech theorizes that hackers could have included the feature to shield the ransomware from analysis by security professionals. That sort of examination often takes place in a controlled environment called a “sandbox.” Researchers construct some of these environments to trick malware into thinking it’s querying outside servers, even though it’s really talking to a bunch of dummy sandbox IP addresses. As a result, any address the malware tries to reach gets a response—even if the actual domain is unregistered. Since the domain MalwareTech acquired was supposed to be dormant but went live, WannaCry may have assumed it was in the middle of forensic analysis, and shut down.

Building anti-analysis defenses into malware is common, but the WannaCry hackers appear to have botched the implementation. By relying on a static, discoverable address, whoever found it—in this case MalwareTech—could just register the domain and trigger WannaCry’s shutdown defense.

“It was all pretty shocking, really,” MalwareTech says. The kill switch “was supposed to work like that, just the domain should [have been] random so people can’t register it.”

The kill switch doesn’t help devices WannaCry has already infected and locked down. But by registering the domain, and then directing the traffic to it into a server environment meant to capture and hold malicious traffic—known as a “sinkhole”—MalwareTech bought time for systems that hadn’t already been infected to be patched for long-term protection, particularly in the United States where WannaCry was slower to proliferate because its spread had mostly been in Europe and Asia early on.

“Thankfully MalwareTech already had infrastructure in place for the sinkhole,” Huss says. “If someone had sinkholed the domain and had not been prepared then we would be seeing many more infections right now.” If the setup doesn’t have those enough server space and bandwidth, the malware wouldn’t consistently become trapped and, in this case anyway, self-destruct.

With so many security analysts working to reverse-engineer and observe WannaCry, someone else would have eventually found the valuable mechanism MalwareTech spotted. But when infections are spreading as quickly as they were on Friday, every minute counts.

The discovery doesn’t amount to a permanent fix. All it would take to get around it would be a new strain of WannaCry whose code excludes the kill switch, or relies on a more sophisticated URL generator instead of a static address. And the more fundamental problem of vulnerable devices, particularly Windows XP devices, remains. Still, MalwareTech’s find helped turn a bad situation around—and saved people a lot of bitcoin in the process.
Shortly after the attack began a researcher found an effective kill switch, which prevented many new infections, and allowed time to patch systems. This greatly slowed the spread. Cyber security authorities discover new versions that lack the kill switch.