Just over a month after the devastating WannaCry ransomware wreaked havoc worldwide, businesses and governments were hit with yet another massive cyberattack sweeping across the globe. On Tuesday, a malware based on Petya — a ransomware that first began making the rounds in 2016 — struck thousands of computers in Ukraine and Russia before spreading throughout Europe and elsewhere.

Some researchers have dubbed the new variant "NotPetya" or "GoldenEye" while some are calling it PetrWrap. Similar to WannaCry, the malware uses the Eternal Blue exploit as one of the means to propagate itself inside a targeted network, takes control of the infected machine and demands $300 (£234) in bitcoin before a victim can regain access.

The ransomware has already affected multiple high-profile firms including Britain's advertising giant WPP, Cadbury in Tasmania, Danish shipping company AP Moller-Maersk, French construction materials firm Saint-Gobain, Russian steel and oil companies Evraz and Rosneft

Ukrainian government departments, the central bank, the airport in Kiev and the metro network have all been affected by the cyberattack as well.

Here is the full list of countries affected by the attack as of the morning of 28 June, 2017: </s> A massive global cyberattack which began in Ukraine against its institutions and corporate networks has been halted, authorities said. According to a government statement, all enterprises, including state-owned ones, were now operating normally, Efe news reported. The situation was “under the full control” of cybersecurity specialists who were working to recover lost data, the government said. Meanwhile, Boryspil International Airport on the outskirts of capital Kiev was still without its main server.

Deputy airport manager Yevgueni Dijne told television channel 112.Ukraina that airlines were working autonomously with their own IT systems and the main departures and arrivals boards were being updated manually every 15 minutes. A type of ransomware called Petya hit dozens of European businesses and institutions on Tuesday, most of them based in Ukraine and Russia, in a cyberattack similar to another in May that affected more than 200,000 users in 150 countries.

You may also like to watch:

According to Russian cybersecurity company Group-IB, Petya is similar to the WannaCry virus, responsible for last month’s attack that paralysed computers and demanded a payment of $300 in bitcoins for a machine to be unblocked. Russian cybersecurity giant Kaspersky Lab warned that the virus had affected computers across the globe. </s> 'Petya' Cyberattack Cripples Ukraine, And Experts Say It's Spreading Globally

Ransomware hit at least six countries Tuesday, including Ukraine, where it was blamed for a large and coordinated attack on key parts of Ukraine's infrastructure, from government agencies and electric grids to stores and banks.

The malware is being called "Petya" — but in the security community, there is a debate over whether the ransomware is new or a variant that has been enhanced to make it harder to stop.

In either case, experts warn that it could spread globally, raising fears of another widespread attack like the WannaCry outbreak that struck in May.

The Maersk shipping company, based in Denmark, has confirmed that its "IT systems are down across multiple sites and business units due to a cyber attack."

In the U.S., the Department of Homeland Security spokesman Scott McConnell says the agency is "monitoring reports of cyber attacks affecting multiple global entities and is coordinating with our international and domestic cyber partners."

Any requests for help from DHS, McConnell says, are confidential.

Computers that are hit by the malware display a locked screen that demands a $300 bitcoin payment to retrieve files.

The malware promises to provide a specialized key to users who pay a ransom of $300 in bitcoins — the same ploy used by the infamous WannaCry ransomware that struck computers in more than 150 countries last month.

WannaCry was based on exploits stolen from the National Security Agency — including a program called EternalBlue, which exploited a Microsoft vulnerability. Petya reportedly shares some of WannaCry's traits — but while computers that had gotten a security patch were safe from WannaCry, Petya can also infect patched machines.

F-Secure executive Mikko Hypponen‏ says that Petya uses other exploits to spread in internal systems. "That's why patched systems can get hit."

Signs that this is a new strain led Kaspersky Lab malware analyst Vyacheslav Zakorzhevsky to say the outbreak comes from a "new ransomware we haven't seen before."

In an update, Kaspersky Labs said the attack has hit thousands of users, in Russia, Ukraine, Poland, Italy, the U.K., Germany, France and the U.S.

Kaspersky is an NPR funder, and we do work with them on our computers.

Ukraine's security experts are working to fix the problem, the government portal says. Until the issue is resolved, the government said, Ukrainians should simply turn their computers off.

While the malware's most concentrated effects were reported in Ukraine, several companies and at least one utility in Russia were also reportedly affected.

From Moscow, NPR's Lucian Kim reports, "Ukraine has blamed Russia for cyberattacks in the past, a charge Moscow denies. A number of Russian companies, including the state oil giant Rosneft, have also reported suffering cyberattacks today."

The attack struck at 2 p.m. local time, Ukraine's government says. Ukraine's National Bank was among the first to report a problem. In Russia, the malware hit companies such as Mars, Nivea and Mondelez International, according to the Tass news agency.

Ukraine's Anton Gerashchenko, a lawmaker and adviser to the interior minister. He says that despite its appearance as a ransomware hack, he believes the attack is actually the work of Russian agents who are waging a type of hybrid warfare to try to destabilize Ukraine.

The malware was delivered in emails that had been created to resemble business correspondence, Gerashchenko said on his Facebook page. He added the attack took days and likely weeks to stage before being activated. </s> 'Petya' ransomware strikes computer servers across globe. Thousands of users has been hit by the virus in Ukraine, the UK, Germany, India, US, Australia.

This is the second global ransomware attack in the last two months after WannaCry attack.

The malicious software locks up computer files with unbreakable encryption. The 'Petya' ransomware takes over computers and demands $300, that needs to be paid in Bitcoin.

The cyber security firm Kaspersky Labs said, they traced the infections to "a new ransomware that has not been seen before"

Have you been affected by this ransomware attack? </s> UK advertising and marketing giant WPP has been hit by a variant of the Petya ransomware

Another massive ransomware attack has broken out in Ukraine and appears to be spreading across the world in a similar vein of the WannaCry cyber attack.

The attack appears to be a variant of the Petya ransomware that has already been spotted in the cyber security wilds before, and hit multiple organisations in Ukraine, including the nation’s state power distributor, the National Bank of Ukraine and Kiev’s main airport.

Now the ransomware appears to have gone global with British advertising and marketing giant WPP noting that IT systems in several of the agencies it owns have been hit by the ransomware, which demands victims send $300 (£234) worth of Bitcoins to the hackers.

Companies in the Netherlands, Russia, and Germany. amongst others, are also reporting ransomware attacks.

GCHQ’s National Cyber Security Centre noted it is leeping a close eye to the spread of Petya: “We are aware of a global ransomware incident and are monitoring the situation closely.”

Further details of the cyber attacks, how they have spread and what types of systems Petya is attacking have yet to surface. Some speculation is laying blame at the doorstep of Russia, which has a rather tense relationship with Ukraine.

Malwabytes malware analyst Hasherezade, noted the cyber security firm is looking into the attacks as they develop.

“We are researching the attack as we speak, and so far it is too soon to tell the extent. What we have uncovered is that the ransomware seems to be distributed by Server Message Block (SMB), which is the same as the WannaCry incident that came before it,” she said. </s> Image copyright Screenshot Image caption Many reports suggest that screens around the world are getting this message, indicating a ransomware attack is to blame.

Companies across the globe are reporting that they have been struck by a major ransomware cyber-attack.

British advertising agency WPP is among those to say its IT systems have been disrupted as a consequence.

The virus, the source of which is not yet known, freezes the user's computer and demands an untraceable ransom be paid in the digital Bitcoin currency.

Ukrainian firms, including the state power company and Kiev's main airport, were among the first to report issues.

The Chernobyl nuclear power plant has also had to monitor radiation levels manually after its Windows-based sensors were shut down.

Interpol involvement

In a statement, the US National Security Council said government agencies were investigating the attack and that the US was "determined to hold those responsible accountable".

The US Department of Homeland Security advised victims not to pay the ransom, saying there was no guarantee that access to files would be restored.

The Russian anti-virus firm Kaspersky Lab said its analysis showed that there had been about 2,000 attacks - most in Ukraine, Russia and Poland.

Media playback is unsupported on your device Media caption Technology explained: what is ransomware?

The international police organisation Interpol has said it was "closely monitoring" the situation and liaising with its member countries.

Experts suggest the malware is taking advantage of the same weaknesses used by the WannaCry attack last month.

"It initially appeared to be a variant of a piece of ransomware that emerged last year," said computer scientist Prof Alan Woodward.

"The ransomware was called Petya and the updated version Petrwrap.

"However, now that's not so clear."

Kaspersky Lab reported that it believed the malware was a "new ransomware that has not been seen before" despite its resemblance to Petya.

As a result, the firm has dubbed it NotPetya. Kaspersky added that it had detected suspected attacks in Poland, Italy, Germany, France and the US in addition to the UK, Russia and Ukraine.

Andrei Barysevich, a spokesman for security firm Recorded Future, told the BBC such attacks would not stop because cyber-thieves found them too lucrative.

"A South Korean hosting firm just paid $1m to get their data back and that's a huge incentive," he said. "It's the biggest incentive you could offer to a cyber-criminal."

A bitcoin wallet associated with the outbreak has received several payments since the outbreak began. The wallet currently holds just over 3.5 bitcoins (£6,775; $8,670).

An email address associated with the blackmail attempt has been blocked by German independent email provider Posteo.

It means that the blackmailers have not been able to access the mailbox.

Problems have also affected:

the aircraft manufacturer Antonov, and two postal services

Russia's biggest oil producer, Rosneft

Danish shipping company Maersk, including its container shipping, oil, gas and drilling operations. A port in Mumbai is among those that has halted operations

a Pennsylvania hospital operator, Heritage Valley Health System, which reported its computer network was down, causing operations to be delayed - but it is not yet clear if it was subject to the same type of attack

US food giant Mondelez - whose brands include Oreo and Toblerone. A Cadbury factory in Tasmania, Australia is affected

Netherlands-based shipping company TNT, which said some of its systems needed "remediation"

French construction materials company St Gobain

US pharmaceuticals-maker Merck Sharp & Dohme

The local offices of the law firm DLA Piper - a sign in the firm's Washington DC office said: "Please remove all laptops from docking stations and keep turned off - no exceptions."

The attacks come two months after another global ransomware assault, known as WannaCry, which caused major problems for the UK's National Health Service.

Veteran security expert Chris Wysopal from Veracode said the malware seemed to be spreading via some of the same Windows code loopholes exploited by WannaCry. Many firms did not patch those holes because WannaCry was tackled so quickly, he added.

Image copyright Twitter/@NCA_UK Image caption The UK's National Crime Agency is investigating the threat

Those being caught out were also industrial firms that often struggled to apply software patches quickly.

"These organisations typically have a challenge patching all of their machines because so many systems cannot have down time," he said. "Airports also have this challenge."

Copies of the virus have been submitted to online testing systems that check if security software, particularly anti-virus systems, were able to spot and stop it.

"Only two vendors were able to detect it so many systems are defenceless if they are unpatched and relying on anti-virus," he said.

Image copyright Twitter/@RozenkoPavlo

Ukraine seems to have been particularly badly hit this time round.

Reports suggest that the Kiev metro system has stopped accepting payment cards while several chains of petrol stations have suspended operations.

Ukraine's deputy prime minister has tweeted a picture appearing to show government systems have been affected.

His caption reads: "Ta-daaa! Network is down at the Cabinet of Minister's secretariat."

Get news from the BBC in your inbox, each weekday morning </s> A global cyberattack leveraging hacking tools widely believed by researchers to have been developed by the U.S. National Security Agency hit international shipper FedEx, disrupted Britain’s health system and infected computers in nearly 100 countries on Friday.

Britain’s National Cyber Security Center said Saturday teams are working “round the clock” to restore hospital computer systems after a global cyberattack that hit dozens of countries forced British hospitals to cancel and delay treatment for patients. In Russia, where a wide array of systems came under attack, officials said services had been restored or the virus contained.

The extortion attack, which locked up computers and held users’ files for ransom, was believed the biggest of its kind ever recorded, disrupting services from the U.S. to Russia, Spain and India. It appeared to exploit a vulnerability purportedly identified for use by the U.S. National Security Agency and later leaked to the internet.

Two security firms — Kaspersky Lab and Avast — said they had identified the malicious software behind the attack in upward of 70 countries, although both said the attack has hit Russia hardest.

WATCH: Hackers have used ransomware to launch a massive cyberattack, affecting more than 70 countires, including Canada. The worst impact seems to be in the United Kingdom, where some hospitals became crippled. Shirlee Engel reports.

The Russian Interior Ministry, which runs the country’s police, confirmed it was among those that fell victim to the “ransomware,” which typically flashes a message demanding payment to release the user’s data. Spokeswoman Irina Volk was quoted by the Interfax news agency Saturday as saying the problem had been “localized” and that no information was compromised.

A spokesman for the Russian Health Ministry, Nikita Odintsov, said on Twitter that the cyberattacks on his ministry were “effectively repelled.” The national railway system said that although it was attacked, rail network operations were unaffected.

British Home Secretary Amber Rudd said Saturday that 45 public health organizations were hit, but she stressed that no patient data had been stolen. The attack froze computers at hospitals across the country, with some cancelling all routine procedures. Patients were asked not to come to hospitals unless it was an emergency.

British media had reported last year that most public health organizations were using an outdated version of Microsoft Windows that was not equipped with security updates.

Elsewhere in Europe, the attack hit companies including Spain’s Telefonica, a global broadband and telecommunications company.

Germany’s national railway said Saturday that departure and arrival display screens at its stations were affected, but there was no impact on actual train services. Deutsche Bahn said it deployed extra staff to busy stations to provide customer information, and recommended that passengers check its website or app for information on their connections.

Other European organizations hit included football clubs in Norway and Sweden, with IF Odd, a 132-year-old Norwegian football club, saying its online ticketing facility was down.

International shipper FedEx Corp said some of its Windows computers were also infected. “We are implementing remediation steps as quickly as possible,” it said in a statement.

Still, only a small number of U.S.-headquartered organizations were hit because the hackers appear to have begun the campaign by targeting organizations in Europe, said Vikram Thakur, research manager with security software maker Symantec.

By the time they turned their attention to the United States, spam filters had identified the new threat and flagged the ransomware-laden emails as malicious, Thakur said.

The U.S. Department of Homeland Security said late on Friday that it was aware of reports of the ransomware, was sharing information with domestic and foreign partners and was ready to lend technical support. </s> Cyber security experts rushed to restore systems on Saturday after an unprecedented global wave of cyberattacks that struck targets ranging from Russia's banks to British hospitals and a French carmaker's factories.

The hunt was on for the culprits behind the assault, which was being described as the biggest cyber ransom attack ever.

State agencies and major companies around the world were left reeling by the attacks which blocked access to files and demanded ransom money, forcing them to shut down their computer systems.

"The recent attack is at an unprecedented level and will require a complex international investigation to identify the culprits," said Europol, Europe's policing agency.

The attacks, which experts said affected dozens of countries, used a technique known as ransomware that locks users' files unless they pay the attackers a designated sum in the virtual Bitcoin currency.

Mikko Hypponen, chief research officer at the Helsinki-based cyber security company F-Secure, told AFP that the attack was "the biggest ransomware outbreak in history", saying that 130,000 systems in more than 100 countries had been affected.

He said that Russia and India were hit particularly hard, in large part because the older Windows XP operating software is still widely used in the countries.

The attacks apparently exploited a flaw exposed in documents leaked from the US National Security Agency (NSA).

The attacks hit a whole range of organisations and businesses worldwide.

French carmaker Renault was forced to stop production at sites in France and Slovenia, saying the measure was aimed at stopping the virus from spreading.

In the United States, package delivery group FedEx acknowledged it had been hit by malware and said it was "implementing remediation steps as quickly as possible."

Russia's interior ministry said that some of its computers had been hit by a "virus attack" and that efforts were underway to destroy it.

The country's central bank said the banking system was hit, and the railway system also reported attempted breaches.

The central bank's IT attack monitoring centre "detected mass distribution of harmful software" but no "instances of compromise", it said.

Russia's largest bank Sberbank said its systems "detected in time attempts to penetrate bank infrastructure".

Germany's Deutsche Bahn computers were also impacted, with the rail operator reporting that station display panels were affected.

In a statement, computer security group Kaspersky Labs said it was "trying to determine whether it is possible to decrypt data locked in the attack — with the aim of developing a decryption tool as soon as possible."

On Saturday, a cyber security researcher told AFP he had accidentally discovered a "kill switch" that could prevent the spread of the ransomware.

The researcher, tweeting as @MalwareTechBlog, said that the discovery was accidental, but that registering a domain name used by the malware stops it from spreading. Computers already affected will not be helped by the solution.

But @MalwareTechBlog warned that the "crisis isn't over" as those behind it "can always change the code and try again".

The malware's name is WCry, but analysts were also using variants such as WannaCry.

Britain's National Cyber Security Centre and its National Crime Agency were looking into the UK incidents, which disrupted care at National Health Service facilities, forcing ambulances to divert and hospitals to postpone operations.

Pictures on social media showed screens of NHS computers with images demanding payment of $300 (230 pounds, 275 euros) in Bitcoin, saying: "Ooops, your files have been encrypted!"

It demands payment in three days or the price is doubled, and if none is received in seven days the files will be deleted, according to the screen message.

"Ransomware becomes particularly nasty when it infects institutions like hospitals, where it can put people's lives in danger," said Kroustek, the Avast analyst.

A hacking group called Shadow Brokers released the malware in April claiming to have discovered the flaw from the NSA, Kaspersky said.

Although Microsoft released a security patch for the flaw earlier this year, many systems have yet to be updated, researchers said.

"Unlike most other attacks, this malware is spreading primarily by direct infection from machine to machine on local networks, rather than purely by email," said Lance Cottrell, chief scientist at the US technology group Ntrepid.

Some said the attacks highlighted the need for agencies like the NSA to disclose security flaws so they can be patched.

G7 finance ministers meeting in Italy discussed the attacks and were expected to commit to stepping up international cooperation against a growing threat to their economies. </s> The Petya ransomware that plagued companies in Europe on Tuesday might have stemmed from corrupted updates of an accountancy software. Reports said that the Ukrainian tax-filing software, M.E.Doc, might have been the source of infection, but the company has denied these allegations.

According to BBC, a number of security experts claim to have logs revealing M.E.Doc as the source. British malware expert Marcus Hutchins, who had been credited with ending the recent WannaCry ransomware outbreak, said that the software’s automatic update system was compromised, and instead of running updates for the software, it was downloading and running malware.

Malware infiltrates networks via email attachments aiming to fool users into clicking on it by mistake. The Petya ransomware, once it has taken over a computer, will encrypt important documents and files and then demands a ransom in Bitcoins; in this case, $300. If the ransom is not paid, the user will risk losing all their files.

The cyberattack led to disruptions among infected companies in 64 countries, including banks in Ukraine, Russian oil giant Rosneft, and the British advertising company, WPP.

Danish shipping giant Maersk was also one of the companies that took a hit in yesterday’s cyberattack. According to BBC, the company was unable to process new orders and was expecting delays on consignments.

Even a Cadbury factory in Tasmania was affected and was forced to stop production as computer systems went down, according to John Short, the Australian Manufacturing and Workers Union state secretary.

While M.E.Doc denied claims that the ransomware sprung from its update, Microsoft published a blog post analyzing how the infection took hold of Windows machines. It pointed the blame at the accounting software.

“Active infections of the ransomware initially started from the legitimate M.E.Doc update process,” the blog entry reveals.

Meanwhile, according to The Guardian, the Petya ransomware looks like just another cybercriminal taking advantage of cyberweapons leaked online. Security experts deem the payment mechanism of the attack to be too amateurish since the ransom note includes the same Bitcoin payment address for every victim. The malware also asks the victim to communicate via a single email address, which was already suspended by the email provider. This means that there is no way to communicate with the attacker to request the decryption key.

According to security researcher Grugq, the recent cyberattack has only a superficial resemblance to Petya, which was a money-making criminal enterprise.

“This is definitely not designed to make money. This is designed to spread fast and cause damage, with a plausibly deniable cover of ‘ransomware,'” Grugq wrote.

The origin of the attack remains unknown, although according to Wired, Ukrainian cybersecurity firms and government agencies pin the attacks on political operatives seeking to disrupt Ukrainian institutions as it targets infrastructure, including an electricity supplier, the state telecom, the central bank, and an airport.
A major ransomware cyberattack strikes companies across the globe and 80% of all infections were in Ukraine.