Just over a month after the devastating WannaCry ransomware wreaked havoc worldwide, businesses and governments were hit with yet another massive cyberattack sweeping across the globe. On Tuesday, a malware based on Petya — a ransomware that first began making the rounds in 2016 — struck thousands of computers in Ukraine and Russia before spreading throughout Europe and elsewhere.

Some researchers have dubbed the new variant "NotPetya" or "GoldenEye" while some are calling it PetrWrap. Similar to WannaCry, the malware uses the Eternal Blue exploit as one of the means to propagate itself inside a targeted network, takes control of the infected machine and demands $300 (£234) in bitcoin before a victim can regain access.

The ransomware has already affected multiple high-profile firms including Britain's advertising giant WPP, Cadbury in Tasmania, Danish shipping company AP Moller-Maersk, French construction materials firm Saint-Gobain, Russian steel and oil companies Evraz and Rosneft

Ukrainian government departments, the central bank, the airport in Kiev and the metro network have all been affected by the cyberattack as well.

Here is the full list of countries affected by the attack as of the morning of 28 June, 2017: </s> Media playback is unsupported on your device Media caption The ransomware involved has been defeated before, reports the BBC's Chris Foxx

NHS services across England and Scotland have been hit by a large-scale cyber-attack that has disrupted hospital and GP appointments.

The prime minister said the incident was part of an untargeted wider attack affecting organisations globally.

Some hospitals and GPs have been unable to access patient data, after their computers were locked by a ransomware program demanding a payment worth £230.

But there is no evidence patient data has been compromised, NHS Digital said.

The BBC understands about 40 NHS organisations and some GP practices have been hit. The NHS in Wales and Northern Ireland has not been affected.

There is no indication of who is behind the attack yet, but the hackers demanded their payment in the virtual currency Bitcoin, which is harder to trace.

Prime Minister Theresa May said: "This is not targeted at the NHS, it's an international attack and a number of countries and organisations have been affected."

Ambulances diverted

Mrs May added that the National Cyber Security Centre (NCSC) was "working closely" with the NHS "to ensure that they support the organisations concerned and that they protect patient safety".

Ambulances have been diverted from hospitals in some areas and there has been disruption at some GP surgeries as a result of the attack.

NHS England said patients in an emergency should go to A&E or access emergency services as they normally would.

Dr Anne Rainsberry, NHS incident director, added: "More widely, we ask people to use the NHS wisely while we deal with this major incident, which is still ongoing."

Media playback is unsupported on your device Media caption Angry doctors, disappointed patients: Reactions to the cyber-attack on the NHS

A massive ransomware campaign appears to have attacked a number of organisations around the world, with reports of infections in more than 70 countries.

Telefonica, the Spanish telecoms company which owns mobile network O2, said it had detected a "cybersecurity incident" but that clients and services had not been affected.

Screenshots of a program that locks computers and demands a payment in Bitcoin have been shared online by those affected.

NHS Digital said the attack was believed to have been carried out by the malware variant Wanna Decryptor.

"Our focus is on supporting organisations to manage the incident swiftly and decisively, but we will continue to communicate with NHS colleagues and will share more information as it becomes available," it said.

Why has the NHS been hit so hard?

Media playback is unsupported on your device Media caption Technology explained: what is ransomware?

There could be a lot of reasons why the NHS was hit so hard by this attack.

The most likely one is because it is a huge organisation supported by a massive IT infrastructure.

It also has lots of partners and suppliers that connect to its core network.

Complexity is the enemy of security and it is a fair bet that some bits of that network, especially those operated by suppliers, are not as well maintained as they should be.

This could mean that patches that would have thwarted WannaCry were not applied.

So, as soon as the worm got in, it could run rampant.

Dr Chris Mimnagh, who works at a medical centre in Liverpool, said the attack had made its job impossible.

"Our entire patient record is accessed through the computer - blood results, history, medicines.

"Most of our prescribing is done electronically... it's sent direct to the pharmacy and... all that is not able to be accessed when we lose the clinical system."

'Power of the state'

Dr Emma Fardon, a GP in Dundee, said she had returned from house visits to find a message on the surgery's computers asking for money.

"We can't access any patient records. Everything is fully computerised," she said.

"We have no idea what drugs people are on or the allergies they have. We can't access the appointments system."

Media playback is unsupported on your device Media caption NHS chief Saffron Cordery tells PM that hospitals are cancelling their operations

Dr Afzal Ashraf, an expert on cyber-security who has previously worked as an adviser to the government, told the BBC it was likely that the malware was spreading when NHS services shared documents and information.

But he also said he thought it was unlikely the attackers had deliberately targeted the NHS.

He added: "I think they probably attacked a small company assuming they would get a small amount of money but it's got into the NHS system and now they have the full power of the state against them - because obviously the government cannot afford for this sort of thing to happen and be successful."

Get news from the BBC in your inbox, each weekday morning </s> After reports emerged on Wednesday afternoon that Boeing had found itself the latest victim of the WannaCry ransomware attack, the company issued a statement to explain that its cybersecurity operations centre had merely detected a "limited intrusion" of malware that had affected a small number of its systems.

Although ZDNet has reached out to Boeing for comment, a statement issued to sister site CNET downplays the concerns over the company's production impact.

"A number of articles on a malware disruption are overstated and inaccurate," Linda Mills, vice president of Boeing commercial airplanes communications, told CNET.

"Our cybersecurity operations center detected a limited intrusion of malware that affected a small number of systems. Remediations were applied and this is not a production or delivery issue."

Claims Boeing had been struck by the virus that caused global panic when it spread last year were made after the company's commercial airplane chief engineer Mike VanderWel distributed a memo to staff that called for "all hands on deck".

"It is metastasizing rapidly out of North Charleston and I just heard 777 (automated spar assembly tools) may have gone down," the Seattle Times reported VanderWel as writing in the memo. He reportedly added that he was concerned the virus would hit equipment used in functional tests of planes ready to roll out and potentially "spread to airplane software".

The WannaCry ransomware, labelled the biggest challenge of 2017, saw ransomware spread with the help of a leaked NSA exploit and infect over 300,000 PCs at major organisations around the globe.

The United Kingdom's National Health Service was one of the highest-profile victims of the attack, with 47 trusts and foundation trusts affected. The ransomware forced a number of hospitals offline and some took weeks to recover.

The United States and its Five Eyes partners blamed the WannaCry ransomware attack on North Korea in December.

A massive cyberattack is hitting organisations around the world

Victims in Ukraine, Russia, Denmark, the UK and the United States have all reported being hit by a cyberattack: authorities are investigating "global ransomware incident".

WannaCry ransomware was the biggest challenge of the year, says cybersecurity centre

Government still learning lessons from ransomware that hit 300,000 PCs worldwide and took down dozens of NHS trusts.

WannaCry ransomware: Now the US says North Korea was to blame

'Cowardly, costly and careless' ransomware attack was the work of North Korean hackers, according to the White House.

Ransomware attacks: Here's what we need to learn from WannaCry and Petya (TechRepublic)

Ransomware is here to stay, which means it's time to make a few changes to how we respond. </s> LONDON - Cyber security experts scrambled Saturday to contain the impact of an unprecedented global cyber-attack that hit Russia’s banks, British hospitals, FedEx and European car factories.

The hunt was on for the culprits behind the assault, which was being described as the biggest-ever cyber ransom attack. State agencies and major companies around the world were left reeling by the attacks which blocked access to files and demanded ransom money, forcing shutdowns of computer systems.

“The recent attack is at an unprecedented level and will require a complex international investigation to identify the culprits,” said Europol, Europe’s policing agency.

The attacks used ransomware, which locks users’ files unless they pay the attackers a designated sum in the virtual Bitcoin currency. Images appeared on victims’ screens demanding payment of $300 (275 euros) in Bitcoin, saying: “Ooops, your files have been encrypted!”

Payment is demanded within three days or the price is doubled, and if none is received within seven days the files will be deleted, according to the screen message. Mikko Hypponen, chief research officer at the Helsinki-based cyber security company F-Secure, told AFP that the attack was “the biggest ransomware outbreak in history”, saying that 130,000 systems in more than 100 countries had been affected.

He said Russia and India were hit particularly hard, largey because tech giant Microsoft’s older Windows XP operating software was still widely used there.

Microsoft said the situation was “painful” and that it was taking “all possible actions to protect our customers”.

It issued guidance for people to protect their systems, while taking the “highly unusual step” of providing a security update “for all customers to protect Windows platforms that are in custom support only”, including Windows XP, Windows 8, and Windows Server 2003 operating systems. US software firm Symantec said the majority of organisations affected were in Europe, and the attack was believed to be indiscriminate.

The ransomware spreads through corporate networks, “without user interaction, by exploiting a known vulnerability in Microsoft Windows,” it said.

The attacks apparently exploited a flaw exposed in documents leaked from the US National Security Agency (NSA).

Laurent Marechal, a cyber security expert at McAfee, said: “We still don’t know if this is worsening or easing. It is too early to tell. We are still in the analysis phase.” In the United States, package delivery group FedEx acknowledged it had been hit by malware and said it was “implementing remediation steps as quickly as possible.” French carmaker Renault was forced to stop production at sites in France, Slovenia and Romania, saying the measure was aimed at stopping the virus from spreading. Japanese carmaker Nissan’s plant in Sunderland, northeast England, was attacked but production shuts on Saturdays in any case.

Russia’s interior ministry said that some of its computers had been hit by a “virus attack” and that efforts were underway to destroy it. The country’s central bank said the Russian banking system was attacked, and the railway system also reported attempted breaches.

The central bank’s IT attack monitoring centre “detected mass distribution of harmful software” but no “instances of compromise”, it said. Germany’s Deutsche Bahn computers were also impacted, with the rail operator reporting that station display panels were affected. Some Italian universities were hit.

In a statement, computer security group Kaspersky Labs said it was “trying to determine whether it is possible to decrypt data locked in the attack - with the aim of developing a decryption tool as soon as possible.” On Saturday, a cyber security researcher told AFP he had accidentally discovered a “kill switch” that could prevent the spread of the ransomware.

The researcher, tweeting as @MalwareTechBlog, said registering a domain name used by the malware stops it from spreading, though it cannot help computers already affected.

A hacking group called Shadow Brokers released the malware in April claiming to have discovered the flaw from the NSA, Kaspersky said. Although Microsoft released a security patch for the flaw earlier this year, many systems have yet to be updated, researchers said.

“Unlike most other attacks, this malware is spreading primarily by direct infection from machine to machine on local networks, rather than purely by email,” said Lance Cottrell, chief scientist at the US technology group Ntrepid.

The unprecedented global cyberattack affected “more than 75,000 victims” in dozens of countries, French police said in a statement Saturday, the day after the ransomware hit Russia’s banks, British hospitals and European car factories among others.

“This is a provisional figure of the number of infected computers and could rise significantly over the coming days,” Valerie Maldonado, deputy head of the French police’s anti-Cybercrime Office told AFP.

Some said the attacks highlighted the need for agencies like the NSA to disclose security flaws so they can be patched.

G7 finance ministers meeting in Italy vowed to unite against cyber crime.

They said cyber incidents represent a growing threat to their economies and should be tackled as a priority. The danger will be discussed at the G7 leaders’ summit next month.

In Britain, the attack disrupted care at National Health Service facilities, forcing ambulances to divert and hospitals to postpone operations.

“There will be lessons to learn from what appears to be the biggest criminal cyber attack in history,” she said.

“But our immediate priority as a government is to disrupt the attack, restore affected services as soon as possible, and establish who was behind it so we can bring them to justice.” </s> Cyber security researchers on Monday found possible North Korea links to the massive WannaCry “ransomware” cyber attacks that first started on May 12. Two security companies found evidence connecting the specific ransomware to North Korean cybergang Lazarus Group, The Guardian reported.

Google researcher Neel Mehta had also published data on Twitter linking the isolated nation to the extortion campaigns that have affected at least three lakh computers in 150 countries.

The two security companies Symantec and Kaspersky Lab said the WannaCry software had a code that was identified in the programmes used by the Lazarus group. “This is the best clue we have seen to date as to the origins of WannaCry,” Kaspersky Lab researcher Kurt Baumgartner told Reuters.

Unidentified officials from the United States and Europe told Reuters that that it was too early to confirm who was responsible for the attacks, but said that North Korea was in their list of suspects. “The similarities we see between malware linked to that group and WannaCry are not unique enough to be strongly suggestive of a common operator,” Cyber security firm FireEye’s researcher John Miller said.

Kaspersky Lab said, “This level of sophistication is something that is not generally found in the cybercriminal world. It’s something that requires strict organization and control at all stages of operation. That’s why we think that Lazarus is not just another advanced persistent threat actor”.

Security experts have warned that India’s banking system could be vulnerable to the attacks.

On Monday, the Indian government had warned users against opening unsolicited emails. The WannaCry virus encrypts the computer’s hard disk drive and then spreads the bug across systems in the same local area network. It also spreads through malicious attachments to emails.

The major cyber attack had targeted several nations, bringing operations at hospitals, telecommunications firms and other companies to a halt. CERT has suggested using patches in users’ Windows systems to prevent the bug from spreading. The ransomware also “drops a file named ‘!Please Read Me!.txt’ that contains the text explaining what has happened [to the computer] and how to pay the ransom”. Microsoft systems seem to be vulnerable to the attacks. </s> LONDON (AP) — A global “ransomware” cyberattack, unprecedented in scale, had technicians scrambling to restore Britain’s crippled hospital network Saturday and secure the computers that run factories, banks, government agencies and transport systems in many other nations.

The worldwide effort to extort cash from computer users is so unprecedented that Microsoft quickly changed its policy, making security fixes available for free for the older Windows systems still used by millions of individuals and smaller businesses.

A malware tracking map showed “WannaCry” infections popping up around the world. Britain canceled or delayed treatments for thousands of patients, even people with cancer. Train systems were hit in Germany and Russia, and phone companies in Madrid and Moscow. Renault’s futuristic assembly line in Slovenia, where rows of robots weld car bodies together, was stopped cold.

In Brazil, the social security system had to disconnect its computers and cancel public access. The state-owned oil company Petrobras and Brazil’s Foreign Ministry also disconnected computers as a precautionary measure, and court systems went down, too.

Britain’s home secretary said one in five of 248 National Health Service groups had been hit. Home Secretary Amber Rudd said all but six of the NHS trusts back to normal Saturday.

The U.K.’s National Cyber Security Center was “working round the clock” to restore vital health services, while urging people to update security software fixes, run anti-virus software and back up their data elsewhere.

Who perpetrated this wave of attacks remains unknown. Two security firms — Kaspersky Lab and Avast — said they identified the malicious software in more than 70 countries. Both said Russia was hit hardest.

These hackers “have caused enormous amounts of disruption– probably the biggest ransomware cyberattack in history,” said Graham Cluley, a veteran of the anti-virus industry in Oxford, England.

And all this may be just a taste of what’s coming, another cyber security expert warned.

Computer users worldwide — and everyone else who depends on them — should assume that the next big “ransomware” attack has already been launched, and just hasn’t manifested itself yet, Ori Eisen, who founded the Trusona cybersecurity firm in Scottsdale, Arizona, told The Associated Press.

The attack held hospitals and other entities hostage by freezing computers, encrypting data and demanding money through online bitcoin payments. But it appears to be “low-level” stuff, Eisen said Saturday, given the amount of ransom demanded — $300 at first, rising to $600 before it destroys files hours later.

He said the same thing could be done to crucial infrastructure, like nuclear power plants, dams or railway systems.

“This is child’s play, what happened. This is not the serious stuff yet. What if the same thing happened to 10 nuclear power plants, and they would shut down all the electricity to the grid? What if the same exact thing happened to a water dam or to a bridge?” he asked.

“Today, it happened to 10,000 computers,” Eisen said. “There’s no barrier to do it tomorrow to 100 million computers.”

This is already believed to be the biggest online extortion attack ever recorded, disrupting services in nations as diverse as the U.S., Ukraine, Brazil, Spain and India. Europol, the European Union’s police agency, said the onslaught was at “an unprecedented level and will require a complex international investigation to identify the culprits.”

In Russia, government agencies insisted that all attacks had been resolved. Russian Interior Ministry, which runs the national police, said the problem had been “localized” with no information compromised. Russia’s health ministry said its attacks were “effectively repelled.”

The ransomware appeared to exploit a vulnerability in Microsoft Windows that was purportedly identified by the U.S. National Security Agency for its own intelligence-gathering purposes. The NSA tools were stolen by hackers and dumped on the internet.

“There’s clearly some culpability on the part of the U.S. intelligence services. Because they could have done something ages ago to get this problem fixed, and they didn’t do it, Cluley said.

“I have some sympathy toward the intelligence services, because it’s very, very difficult these days, with encryption, to spy on people,” Cluley added. “But I don’t think that those concerns should hide the fact that ALL of us need to be protected … We’re living an online life, and we all deserve security there.”

It could have been much worse if not for a young cybersecurity researcher who helped to halt its spread by accidentally activating a so-called “kill switch” in the malicious software.

The 22-year-old Britain-based researcher, identified online only as MalwareTech, explained Saturday how he registered a garbled domain name he spotted in the code. His $11 purchase of the name on Friday activated the domain, which commanded the malware to stop spreading. It may have saved governments and companies millions of dollars and slowed the outbreak before U.S.-based computers were more widely infected.

Indeed, while FedEx Corp. reported that its Windows computers were “experiencing interference” from malware — it wouldn’t say if it had been hit by the ransomware — other impacts in the U.S. were not readily apparent on Saturday.

The kill switch couldn’t help those already infected, however. Short of paying, options for these individuals and companies are usually limited to recovering data files from a backup, if available, or living without them.

Security experts said it appeared to be caused by a self-replicating piece of software that enters companies when employees click on email attachments, then spreads quickly as employees share documents.

The security holes it exploits were disclosed weeks ago by TheShadowBrokers, a mysterious group that published what it said are hacking tools used by the NSA. Microsoft swiftly announced that it had already issued software “patches” to fix those holes, but many users haven’t yet installed updates or still use older versions of Windows.

Microsoft had made fixes for older systems, such as 2001’s Windows XP, available only to mostly larger organizations, including Britain’s National Health Service, that paid extra for extended technical support.

In light of Friday’s attacks, Microsoft announced that it’s making the fixes free to all.

Copyright 2017 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed. </s> investigators hunted for those behind an unprecedented cyber-attack that affected systems in dozens of countries, including at banks, hospitals and government agencies, as security experts sought to contain the fallout.

The assault, which began Friday and was being described as the biggest-ever cyber ransom attack, struck state agencies and major companies around the world — from Russian banks and British hospitals to FedEx and European car factories.

"The recent attack is at an unprecedented level and will require a complex investigation to identify the culprits," said Europol, Europe's police agency.

Europol said a special task force at its European Centre was "specially designed to assist in such investigations and will play an important role in supporting the investigation".

The attacks used ransomware that apparently exploited a security flaw in operating systems, locking users' files unless they pay the attackers a designated sum in the virtual currency

Images appeared on victims' screens demanding payment of $300 in Bitcoin, saying: "Ooops, your files have been encrypted!"

Payment is demanded within three days or the price is doubled, and if none is received within seven days the files will be deleted, according to the screen message.

But experts and government alike warn against ceding to the hackers' demands.

"Paying the ransom does not guarantee the encrypted files will be released," the US Department of Homeland Security's computer emergency response team said.

"It only guarantees that the malicious actors receive the victim's money, and in some cases, their banking information."

Experts and officials offered differing estimates of the scope of the attacks, but all agreed it was huge.

Mikko Hypponen, chief research officer at the Helsinki- based cyber security company F-Secure, told AFP it was the biggest ransomware outbreak in history, saying that 130,000 systems in more than 100 countries had been affected.

He said and India were hit particularly hard, largely because Microsoft's Windows XP — one of the operating systems most at risk — was still widely used there.

French police said there were "more than 75,000 victims" around the globe, but cautioned that the number could increase "significantly".

The virus spread quickly because the culprits used a digital code believed to have been developed by the US National Security Agency — and subsequently leaked as part of a document dump, according to researchers at the Moscow-based computer security firm Kaspersky Lab. </s> A ransomware attack appears to be spreading around the world, leveraging a hacking tool that may have come from the U.S. National Security Agency.

The ransomware, called Wanna Decryptor, struck hospitals at the U.K.’s National Health Service on Friday, taking down some of their network.

Spain’s computer response team CCN-CERT has also warned of a "massive attack" from the ransomware strain, amid reports that local telecommunications firm Telefonica was hit.

The ransomware, also known as WannaCry, works by leveraging a Windows vulnerability that came to light last month when a cache of mysterious hacking tools was leaked on the internet.

The tools, which security researchers suspect came from the NSA, include an exploit codenamed EternalBlue that makes hijacking older Windows systems easy. It specifically targets the Server Message Block (SMB) protocol in Windows, which is used for file-sharing purposes.

Microsoft has already patched the vulnerability, but only for newer Windows systems. Older ones, such as Windows Server 2003, are no longer supported, but still widely used among businesses, according to security experts.

That may have painted a giant bulls-eye for hackers to target these systems. The developer of Wanna Decryptor appears to have added the suspected NSA hacking tools to the ransomware’s code, said Matthew Hickey, the director of security provider Hacker House, in an email.

Security firm Avast said it has detected the ransomware, largely attacking Russia, Ukraine and Taiwan.

Another security research firm, MalwareTech, has created a page monitoring the attacks. They appear to have gone worldwide.

The Wanna Decryptor ransomware strikes by encrypting all the files on an infected PC, along with any other systems on the network the PC is attached to. It then demands a ransom of about $300 to $600 in bitcoin to release the files, threatening to delete them after a set period of days if the amount is not paid.

Security experts are urging organizations to patch vulnerable systems, upgrading to the latest versions of OSes, and making backups of any critical files. </s> Hong Kong: A cyber-security researcher appears to have discovered a "kill switch" that can prevent the spread of the WannaCry ransomware, for now, that has caused the cyberattacks wreaking havoc globally.

The researcher, tweeting as @MalwareTechBlog, said the discovery was accidental, but that registering a domain name used by the malware stops it from spreading.

"Essentially they relied on a domain not being registered and by registering it, we stopped their malware spreading," @MalwareTechBlog told AFP in a private message on Twitter.

 The researcher warned however that people "need to update their systems ASAP" to avoid attack.

"The crisis isn't over, they can always change the code and try again," @MalwareTechBlog said.

Friday's wave of cyberattacks, which affected dozens of countries, apparently exploited a flaw exposed in documents leaked from the US National Security Agency.

The attacks used a technique known as ransomware that locks users' files unless they pay the attackers a designated sum in the virtual currency Bitcoin.

Affected by the onslaught were computer networks at hospitals in Britain, Russia's interior ministry, the Spanish telecom giant Telefonica and the US delivery firm FedEx and many other organisations.

French carmaker Renault also announced it was attacked. A spokeswoman said the company was "doing what is needed to counter this attack."

"I will confess that I was unaware registering the domain would stop the malware until after I registered it, so initially it was accidental," @MalwareTechBlog tweeted.

Unfortunately however, computers already affected will not be helped by the solution. "So long as the domain isn't revoked, this particular strain will no longer cause harm, but patch your systems ASAP as they will try again."

The malware's name is WCry, but analysts were also using variants such as WannaCry.

Forcepoint Security Labs said in a Friday statement that the attack had "global scope" and was affecting networks in Australia, Belgium, France, Germany, Italy and Mexico. In the United States, FedEx acknowledged it had been hit by malware and was "implementing remediation steps as quickly as possible."

Also badly hit was Britain's National Health Service, which declared a "major incident" after the attack, which forced some hospitals to divert ambulances and scrap operations. Pictures posted on social media showed screens of NHS computers with images demanding payment of USD 300 (275 euros) in Bitcoin, saying: "Ooops, your files have been encrypted!"

It demands payment in three days or the price is doubled, and if none is received in seven days, the files will be deleted, according to the screen message.

A hacking group called Shadow Brokers released the malware in April claiming to have discovered the flaw from the NSA, according to Kaspersky Lab, a Russian cybersecurity provider.

Kaspersky researcher Costin Raiu cited 45,000 attacks in 74 countries as of Friday evening.
A large scale international cyber-attack using the WannaCry ransomware package disrupts computer and telephone systems in thousands of cases across 99 countries. Affected organisations include: England's NHS, with doctors reporting messages demanding money; MegaFon and Sberbank in Russia; Telefónica, Iberdrola, and Gas Natural in Spain; and FedEx.