A global police operation shut down the servers of one of the world's largest malware platforms that targeted millions of victims, the EU's judicial arm said on Tuesday (Oct 29).

A year-long investigation culminated in "Operation Magnus" with investigators from six countries including the Netherlands, Australia, Britain and the United States working together to smash the criminal scheme.&nbsp;

"The infostealers taken down...targeted millions of victims worldwide, making it one of the largest malware platforms globally," Eurojust said in a statement.

"Authorities discovered that over 1,200 servers in dozens of countries were running the malware," said the agency, which is based in The Hague and coordinated Monday's operation.

Also Read |&nbsp;<a href="https://www.wionews.com/world/oregon-us-presidential-election-2024-voting-candidates-results-and-all-you-need-to-know-771750">Oregon US Presidential Election 2024: Voting, candidates, results and all you need to know</a>

Investigators shut down three servers in the Netherlands, seized two domains, unsealed charges in the United States and took two people into custody in Belgium, Eurojust said.

The criminal platforms, called RedLine and META, stole personal data from infected devices including usernames and passwords, as well as automatically saved data like addresses, email addresses and cryptocurrency wallets.

The victims' devices became infected when downloading software from unreliable sources.

The investigation was triggered when victims came forward and a security company notified authorities about possible servers in the Netherlands linked to the malware.&nbsp;

Also Read |&nbsp;<a href="https://www.wionews.com/us-elections/new-mexico-us-presidential-election-2024-voting-result-info-candidates-and-all-you-need-to-know-771737">New Mexico US Presidential Election 2024: Voting, Result info, Candidates and all you need to know</a>

"After retrieving the personal data, the infostealers sold the information to other criminals through criminal marketplaces," Eurojust said.

"The criminals who purchased the personal data used it to steal money, crypto-currency and to carry out follow-on hacking activities," the agency said.

Authorities have also taken down several Telegram messaging accounts which were used to advertise RedLine and META's services, Dutch police said.

"Until recently, Telegram was a service where criminals felt untouchable and anonymous," they said in a statement.

"This action has shown that this is no longer the case," police added.

In the United States, law officials have slapped fraud and money laundering charges on a suspected RedLine developer and administrator.

If convicted the suspect "faces a maximum penalty of 10 years in prison for access device fraud, five years in prison for conspiracy to commit computer intrusion, and 20 years in prison for money laundering," the US Attorney's Office said in a statement.

Eurojust and Dutch police confirmed that the META name used by the malware platform had no link with Meta, the California-based company that owns Facebook, Instagram and WhatsApp.

Investigations continued and Eurojust said a private security company has set up an online tool for potential victims to check if their data was stolen.

US law authorities added it "did not believe it is in possession of all the stolen data and continues to investigate."

Disclaimer: This story has been published from a news agency feed with minimal edits to adhere to WION's style guide. The headline may have been changed to better reflect the content of the story or to make it more suitable for&nbsp;WION&nbsp;audience.

A global police operation shut down the servers of one of the world's largest malware platforms that targeted millions of victims, the EU's judicial arm said on Tuesday (Oct 29).

A global police operation shut down the servers of one of the world's largest malware platforms that targeted millions of victims, the EU's judicial arm said on Tuesday (Oct 29). A year-long investigation culminated in "Operation Magnus" with investigators from six countries including the Netherlands, Australia, Britain and the United States working together to smash the criminal scheme. "The infostealers taken down...targeted millions of victims worldwide, making it one of the largest malware platforms globally," Eurojust said in a statement. "Authorities discovered that over 1,200 servers in dozens of countries were running the malware," said the agency, which is based in The Hague and coordinated Monday's operation. Also Read | Oregon US Presidential Election 2024: Voting, candidates, results and all you need to know Investigators shut down three servers in the Netherlands, seized two domains, unsealed charges in the United States and took two people into custody in Belgium, Eurojust said. The criminal platforms, called RedLine and META, stole personal data from infected devices including usernames and passwords, as well as automatically saved data like addresses, email addresses and cryptocurrency wallets. The victims' devices became infected when downloading software from unreliable sources. The investigation was triggered when victims came forward and a security company notified authorities about possible servers in the Netherlands linked to the malware. Also Read | New Mexico US Presidential Election 2024: Voting, Result info, Candidates and all you need to know "After retrieving the personal data, the infostealers sold the information to other criminals through criminal marketplaces," Eurojust said. "The criminals who purchased the personal data used it to steal money, crypto-currency and to carry out follow-on hacking activities," the agency said. Authorities have also taken down several Telegram messaging accounts which were used to advertise RedLine and META's services, Dutch police said. "Until recently, Telegram was a service where criminals felt untouchable and anonymous," they said in a statement. "This action has shown that this is no longer the case," police added. In the United States, law officials have slapped fraud and money laundering charges on a suspected RedLine developer and administrator. If convicted the suspect "faces a maximum penalty of 10 years in prison for access device fraud, five years in prison for conspiracy to commit computer intrusion, and 20 years in prison for money laundering," the US Attorney's Office said in a statement. Eurojust and Dutch police confirmed that the META name used by the malware platform had no link with Meta, the California-based company that owns Facebook, Instagram and WhatsApp. Investigations continued and Eurojust said a private security company has set up an online tool for potential victims to check if their data was stolen. US law authorities added it "did not believe it is in possession of all the stolen data and continues to investigate." Disclaimer: This story has been published from a news agency feed with minimal edits to adhere to WION's style guide. The headline may have been changed to better reflect the content of the story or to make it more suitable for WION audience.

Global police shut down largest malware group 'targeting millions': EU judicial arm

Users of Samsung, Huawei, and Google phones have been advised to remove a number of popular apps that may contain spyware which steals money.

Tech experts have cautioned owners of Android smartphones and tablets that a variety of apps could be infected with harmful malware called 'Harly'.

What is Harly?

Harly, named after Harley Quinn the popular Batman villain, who is also the Joker's girlfriend, is a type of trojan known as a "trojan subscriber" signs users up for paid services without their knowledge.&nbsp;

Watch |&nbsp;Tech Talk: Popular apps capable of collecting private information on iPhones

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/tech-talk-popular-apps-capable-of-collecting-private-information-on-iphones-509289/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

Since 2020, more than 190 Harly-infected apps have been discovered on Google Play, according to Kaspersky. The well-known antivirus supplier estimates that 4.8 million people have downloaded these apps, however, the actual number may be far higher.

How does it work?

The Harly family of Trojans imitates trustworthy applications. Scammers download common apps from Google Play, add malicious code to them, and then submit the altered versions to Google Play. Users might not even be aware that the apps are dangerous because they still have the functions that are provided in the description.

Also read |&nbsp;<a href="https://www.wionews.com/technology/google-deletes-50-apps-after-joker-malware-attack-users-should-delete-them-if-they-are-installed-501251">Google deletes 50 apps infected with Joker malware. Recommends users to delete the apps if installed</a>

But don't you need a verification code for paid subscriptions?

Yes, you do. However, according to The Daily Express, Harly can sign up Android users for pricey subscription services without their knowledge by stealthily taking security codes from text messages.

It can also check subscriptions over the phone without the device owner's knowledge, and once this is done, it could empty someone's bank account without being noticed.

Also read |&nbsp;<a href="https://www.wionews.com/world/us-discovers-malware-capable-of-gaining-access-to-industrial-control-systems-issues-alert-471072">US discovers malware capable of gaining access to industrial control systems, issues alert</a>

How do we protect ourselves?

The company advises reading user reviews and viewing an app's rating on Google Play before installing it. But bear in mind that ratings and reviews could be inflated. Another solution it recommends is of course "a reliable security solution."&nbsp;

Which apps have been affected?

Kaspersky, which first flagged the malware has made mention of a number of apps, some of which already have thousands of downloads. Here are a few apps that you need to skirt clear of:

-Pony Camera&nbsp; 
-Live Wallpaper&amp;Themes Launcher 
-Action Launcher &amp; Wallpapers&nbsp; 
-Color Call 
-Good Launcher&nbsp; 
-Mondy Widgets 
-Funcalls-Voice Changer 
-Eva Launcher 
-Newlook Launcher 
-Pixel Screen Wallpaper

(With inputs from agencies)

WATCH WION LIVE HERE

<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="350" loading="”lazy”" src="https://www.wionews.com/live-tv/embed?autoplay=1&amp;mute=1" width="100%"></iframe>

You can now write for wionews.com and be a part of the community. Share your stories and opinions with us <a href="https://www.wionews.com/content-contribution-registration-form">here</a>.

Users of Samsung, Huawei, and Google phones have been advised to remove a number of popular apps that may contain spyware which steals money. Tech experts have cautioned owners of Android smartphones and tablets that a variety of apps could be infected with harmful malware called 'Harly'.

Users of Samsung, Huawei, and Google phones have been advised to remove a number of popular apps that may contain spyware which steals money. Tech experts have cautioned owners of Android smartphones and tablets that a variety of apps could be infected with harmful malware called 'Harly'. What is Harly? Harly, named after Harley Quinn the popular Batman villain, who is also the Joker's girlfriend, is a type of trojan known as a "trojan subscriber" signs users up for paid services without their knowledge. Watch | Tech Talk: Popular apps capable of collecting private information on iPhones Since 2020, more than 190 Harly-infected apps have been discovered on Google Play, according to Kaspersky. The well-known antivirus supplier estimates that 4.8 million people have downloaded these apps, however, the actual number may be far higher. How does it work? The Harly family of Trojans imitates trustworthy applications. Scammers download common apps from Google Play, add malicious code to them, and then submit the altered versions to Google Play. Users might not even be aware that the apps are dangerous because they still have the functions that are provided in the description. Also read | Google deletes 50 apps infected with Joker malware. Recommends users to delete the apps if installed But don't you need a verification code for paid subscriptions? Yes, you do. However, according to The Daily Express, Harly can sign up Android users for pricey subscription services without their knowledge by stealthily taking security codes from text messages. It can also check subscriptions over the phone without the device owner's knowledge, and once this is done, it could empty someone's bank account without being noticed. Also read | US discovers malware capable of gaining access to industrial control systems, issues alert How do we protect ourselves? The company advises reading user reviews and viewing an app's rating on Google Play before installing it. But bear in mind that ratings and reviews could be inflated. Another solution it recommends is of course "a reliable security solution." Which apps have been affected? Kaspersky, which first flagged the malware has made mention of a number of apps, some of which already have thousands of downloads. Here are a few apps that you need to skirt clear of: -Pony Camera -Live Wallpaper&Themes Launcher -Action Launcher & Wallpapers -Color Call -Good Launcher -Mondy Widgets -Funcalls-Voice Changer -Eva Launcher -Newlook Launcher -Pixel Screen Wallpaper (With inputs from agencies) WATCH WION LIVE HERE You can now write for wionews.com and be a part of the community. Share your stories and opinions with us here.

Explained: 'Harly' the latest malware in market, that can drain your bank accounts

A Chinese cyberespionage group named Bronze President, which also goes by the name Mustang Panda, has been using a malware named PlugX to target the computers of political leaders across the globe.

A Chinese cyberespionage group named Bronze President, which also goes by the name Mustang Panda, has been using a malware named PlugX to target the computers of political leaders across the globe. Secureworks Counter Threat Unit (CTU), a company that analyses threat data across the planet, observed a series of attacks in the month of July that used the LuhX malware. Government officials in Europe, West Asia, and South America were reportedly targeted. Read more: China launched cyberattack against Ukraine before Russian invasion: Report According to CTU, the footprint of the attack bore similarities to previous attacks by Bronze President. The Chinese espionage group imitated official diplomatic notices and lured the government officials. “Several characteristics of this campaign indicate that it was conducted by the likely Chinese government-sponsored Bronze President threat group, including the use of PlugX, file paths and naming schemes previously used by the threat group, the presence of shellcode in executable file headers, and politically themed decoy documents that align with regions where China has interests,” the CTU research team wrote in a statement. Explaining that the PlugX malware had capabilities beyond just information gathering, the CTU team further added. "PlugX is modular malware that contacts a command and control (C2) server for tasking and can download additional plugins to enhance its capability beyond basic information gathering," it said. It is pertinent to note that the malware usually arrived in the victim's computer, embedded within RAR archive files. Upon opening the file, the user is shown a Windows shortcut (LNK) file. Once the user clicks on the LNK file, the Plux malware is loaded, decrypted and executed in the system. The group stated that recently a Turkish official was targeted using a similar modus-operandi. The official received a notification letter, supposedly from the UK government, informing about the appointment of a new ambassador. However. the truth is there has been no change in the personnel. Opening the mail could have compromised the official. The cybersecurity firm advised that countries and organisations that China has an interest in could be at the most risk of being targeted and thus they needed to be aware of the group's activities. “Organisations in geographic regions of interest to China should closely monitor this group’s activities, especially organisations associated with or operating as government agencies,” read the statement. (With inputs from agencies) WATCH WION LIVE HERE:

Chinese hackers target foreign government officials using a new malware

Two-thirds of those caught up in the past week&#39;s global ransomware attack were running Microsoft&#39;s Windows 7 operating system without the latest security updates, a survey for Reuters by security ratings firm BitSight found.

Researchers are struggling to try to find early traces of WannaCry, which remains an active threat in hardest-hit China and Russia, believing that identifying &quot;patient zero&quot; could help catch its criminal authors.

They are having more luck dissecting flaws that limited its spread.

Security experts warn that while computers at more than 3,00,000 internet addresses were hit by the ransomware strain, further attacks that fix weaknesses in WannaCry will follow that hit larger numbers of users, with more devastating consequences.

&quot;Some organisations just aren&#39;t aware of the risks; some don&#39;t want to risk interrupting important business processes; sometimes they are short-staffed,&quot; said Ziv Mador, vice president of security research at Israel&#39;s SpiderLabs Trustwave.

&quot;There are plenty of reasons people wait to patch and none of them are good,&quot; said Mador, a former long-time security researcher for Microsoft.

WannaCry&#39;s worm-like capacity to infect other computers on the same network with no human intervention appear tailored to Windows 7, said Paul Pratley, head of investigations &amp; incident response at UK consulting firm MWR InfoSecurity.

Data from BitSight covering 160,000 internet-connected computers hit by WannaCry, shows that Windows 7 accounts for 67 per cent of infections, although it represents less than half of the global distribution of Windows PC users.

Computers running older versions, such as Windows XP used in Britain&#39;s NHS health system, while individually vulnerable to attack, appear incapable of spreading infections and played a far smaller role in the global attack than initially reported.

In laboratory testing, researchers at MWR and Kyptos say they have found Windows XP crashes before the virus can spread.

Windows 10, the latest version of Microsoft&#39;s flagship operating system franchise, accounts for another 15 per cent, while older versions of Windows including 8.1, 8, XP and Vista, account for the remainder, BitSight estimated.

Computer basics

Any organisation which heeded strongly worded warnings from Microsoft to urgently install a security patch it labelled &ldquo;critical&rdquo; when it was released on March 14 on all computers on their networks are immune, experts agree.

Those hit by WannaCry also failed to heed warnings last year from Microsoft to disable a file sharing feature in Windows known as SMB, which a covert hacker group calling itself Shadow Brokers had claimed was used by NSA intelligence operatives to sneak into Windows PCs.

&quot;Clearly people who run supported versions of Windows and patched quickly were not affected&quot;, Trustwave&#39;s Mador said.

Microsoft has faced criticism since 2014 for withdrawing support for older versions of Windows software such as 16-year-old Windows XP and requiring users to pay hefty annual fees instead. The British government cancelled a nationwide NHS support contract with Microsoft after a year, leaving upgrades to local trusts.

Seeking to head off further criticism in the wake of the WannaCry outbreak, the US&nbsp;software giant last weekend released a free patch for Windows XP and other older Windows versions that it previously only offered to paying customers.

Microsoft declined to comment for this story.

On Sunday, the US&nbsp;software giant called on intelligence services to strike a better balance between their desire to keep software flaws secret - in order to conduct espionage and cyber warfare - and sharing those flaws with technology companies to better secure the internet.

Half of all internet addresses corrupted globally by WannaCry are located in China and Russia, with 30 and 20 per cent respectively. Infection levels spiked again in both countries this week and remained high through Thursday, according to data supplied to Reuters by threat intelligence firm Kryptos Logic.

By contrast, the United States accounts for 7 per cent of WannaCry infections while Britain, France and Germany each represent just 2 per cent of worldwide attacks, Kryptos said.

Dumb and sophisticated

The ransomware mixes copycat software loaded with amateur coding mistakes and recently leaked spy tools widely believed to have been stolen from the US&nbsp;National Security Agency, creating a vastly potent class of crimeware.

&quot;What really makes the magnitude of this attack so much greater than any other is that the intent has changed from information stealing to business disruption&quot;, said Samil Neino, 32, chief executive of Los Angeles-based Kryptos Logic.

Last Friday, the company&#39;s British-based 22-year-old data breach research chief, Marcus Hutchins, created a &quot;kill-switch&quot;, which security experts have widely hailed as the decisive step in halting the ransomware&#39;s rapid spread around the globe.

WannaCry appears to target mainly enterprises rather than consumers: Once it infects one machine, it silently proliferates across internal networks which can connect hundreds or thousands of machines in large firms, unlike individual consumers at home.

An unknown number of computers sit behind the 3,00,000 infected internet connections identified by Kryptos.

Because of the way WannaCry spreads sneakily inside organisation networks, a far larger total of ransomed computers sitting behind company firewalls may be hit, possibly numbering upward of a million machines. The company is crunching data to arrive at a firmer estimate it aims to release later Thursday.

Liran Eshel, chief executive of cloud storage provider CTERA Networks, said: &quot;The attack shows how sophisticated ransomware has become, forcing even unaffected organisations to rethink strategies.&quot;

Escape route

Researchers from a variety of security firms say they have so far failed to find a way to decrypt files locked up by WannaCry and say chances are low anyone will succeed.

However, a bug in WannaCry code means the attackers cannot use unique bitcoin addresses to track payments, security researchers at Symantec found this week. The result: &quot;Users unlikely to get files restored&quot;, the company&#39;s Security Response team tweeted.

The rapid recovery by many organisations with unpatched computers caught out by the attack may largely be attributed to back-up and retrieval procedures they had in place, enabling technicians to re-image infected machines, experts said.

While encrypting individual computers it infects, WannaCry code does not attack network data-backup systems, as more sophisticated ransomware packages typically do, security experts who have studied WannaCry code agree.

These factors help explain the mystery of why such a tiny number of victims appear to have paid ransoms into the three bitcoin accounts to which WannaCry directs victims.

Less than 300 payments worth around $83,000 had been paid into WannaCry blackmail accounts by Thursday (1800 GMT), six days after the attack began and one day before the ransomware threatens to start locking up victim computers forever.

The Verizon 2017 Data Breach Investigations Report, the most comprehensive annual survey of security breakdowns, found that it takes three months before at least half of organisations install major new software security patches.

WannaCry landed nine weeks after Microsoft&#39;s patch arrived.

&quot;The same things are causing the same problems. That&#39;s what the data shows,&quot; MWR research head Pratley said.

&quot;We haven&#39;t seen many organisations fall over and that&#39;s because they did some of the security basics,&quot; he said.

(Reuters)

Researchers are struggling to try to find early traces of WannaCry

Two-thirds of those caught up in the past week's global ransomware attack were running Microsoft's Windows 7 operating system without the latest security updates, a survey for Reuters by security ratings firm BitSight found. Researchers are struggling to try to find early traces of WannaCry, which remains an active threat in hardest-hit China and Russia, believing that identifying "patient zero" could help catch its criminal authors. They are having more luck dissecting flaws that limited its spread. Security experts warn that while computers at more than 3,00,000 internet addresses were hit by the ransomware strain, further attacks that fix weaknesses in WannaCry will follow that hit larger numbers of users, with more devastating consequences. "Some organisations just aren't aware of the risks; some don't want to risk interrupting important business processes; sometimes they are short-staffed," said Ziv Mador, vice president of security research at Israel's SpiderLabs Trustwave. "There are plenty of reasons people wait to patch and none of them are good," said Mador, a former long-time security researcher for Microsoft. WannaCry's worm-like capacity to infect other computers on the same network with no human intervention appear tailored to Windows 7, said Paul Pratley, head of investigations & incident response at UK consulting firm MWR InfoSecurity. Data from BitSight covering 160,000 internet-connected computers hit by WannaCry, shows that Windows 7 accounts for 67 per cent of infections, although it represents less than half of the global distribution of Windows PC users. Computers running older versions, such as Windows XP used in Britain's NHS health system, while individually vulnerable to attack, appear incapable of spreading infections and played a far smaller role in the global attack than initially reported. In laboratory testing, researchers at MWR and Kyptos say they have found Windows XP crashes before the virus can spread. Windows 10, the latest version of Microsoft's flagship operating system franchise, accounts for another 15 per cent, while older versions of Windows including 8.1, 8, XP and Vista, account for the remainder, BitSight estimated. Computer basics Any organisation which heeded strongly worded warnings from Microsoft to urgently install a security patch it labelled “critical” when it was released on March 14 on all computers on their networks are immune, experts agree. Those hit by WannaCry also failed to heed warnings last year from Microsoft to disable a file sharing feature in Windows known as SMB, which a covert hacker group calling itself Shadow Brokers had claimed was used by NSA intelligence operatives to sneak into Windows PCs. "Clearly people who run supported versions of Windows and patched quickly were not affected", Trustwave's Mador said. Microsoft has faced criticism since 2014 for withdrawing support for older versions of Windows software such as 16-year-old Windows XP and requiring users to pay hefty annual fees instead. The British government cancelled a nationwide NHS support contract with Microsoft after a year, leaving upgrades to local trusts. Seeking to head off further criticism in the wake of the WannaCry outbreak, the US software giant last weekend released a free patch for Windows XP and other older Windows versions that it previously only offered to paying customers. Microsoft declined to comment for this story. On Sunday, the US software giant called on intelligence services to strike a better balance between their desire to keep software flaws secret - in order to conduct espionage and cyber warfare - and sharing those flaws with technology companies to better secure the internet. Half of all internet addresses corrupted globally by WannaCry are located in China and Russia, with 30 and 20 per cent respectively. Infection levels spiked again in both countries this week and remained high through Thursday, according to data supplied to Reuters by threat intelligence firm Kryptos Logic. By contrast, the United States accounts for 7 per cent of WannaCry infections while Britain, France and Germany each represent just 2 per cent of worldwide attacks, Kryptos said. Dumb and sophisticated The ransomware mixes copycat software loaded with amateur coding mistakes and recently leaked spy tools widely believed to have been stolen from the US National Security Agency, creating a vastly potent class of crimeware. "What really makes the magnitude of this attack so much greater than any other is that the intent has changed from information stealing to business disruption", said Samil Neino, 32, chief executive of Los Angeles-based Kryptos Logic. Last Friday, the company's British-based 22-year-old data breach research chief, Marcus Hutchins, created a "kill-switch", which security experts have widely hailed as the decisive step in halting the ransomware's rapid spread around the globe. WannaCry appears to target mainly enterprises rather than consumers: Once it infects one machine, it silently proliferates across internal networks which can connect hundreds or thousands of machines in large firms, unlike individual consumers at home. An unknown number of computers sit behind the 3,00,000 infected internet connections identified by Kryptos. Because of the way WannaCry spreads sneakily inside organisation networks, a far larger total of ransomed computers sitting behind company firewalls may be hit, possibly numbering upward of a million machines. The company is crunching data to arrive at a firmer estimate it aims to release later Thursday. Liran Eshel, chief executive of cloud storage provider CTERA Networks, said: "The attack shows how sophisticated ransomware has become, forcing even unaffected organisations to rethink strategies." Escape route Researchers from a variety of security firms say they have so far failed to find a way to decrypt files locked up by WannaCry and say chances are low anyone will succeed. However, a bug in WannaCry code means the attackers cannot use unique bitcoin addresses to track payments, security researchers at Symantec found this week. The result: "Users unlikely to get files restored", the company's Security Response team tweeted. The rapid recovery by many organisations with unpatched computers caught out by the attack may largely be attributed to back-up and retrieval procedures they had in place, enabling technicians to re-image infected machines, experts said. While encrypting individual computers it infects, WannaCry code does not attack network data-backup systems, as more sophisticated ransomware packages typically do, security experts who have studied WannaCry code agree. These factors help explain the mystery of why such a tiny number of victims appear to have paid ransoms into the three bitcoin accounts to which WannaCry directs victims. Less than 300 payments worth around $83,000 had been paid into WannaCry blackmail accounts by Thursday (1800 GMT), six days after the attack began and one day before the ransomware threatens to start locking up victim computers forever. The Verizon 2017 Data Breach Investigations Report, the most comprehensive annual survey of security breakdowns, found that it takes three months before at least half of organisations install major new software security patches. WannaCry landed nine weeks after Microsoft's patch arrived. "The same things are causing the same problems. That's what the data shows," MWR research head Pratley said. "We haven't seen many organisations fall over and that's because they did some of the security basics," he said. (Reuters)

WannaCry: Security experts find clues to ransomware worm's lingering risks

Governments turned their attention to a possible new wave of cyber threats after the group that leaked US&nbsp;hacking tools used to launch the global WannaCry &quot;ransomware&quot; attack warned it would release more malicious code.

The fast-spreading cyber extortion campaign, which has infected more than 3,00,000 computers worldwide since Friday, eased for second day on Tuesday, but the identity and motive of its creators remain unknown.

The attack includes elements that belong to the US&nbsp;National Security Agency and were leaked online last month.

Shadow Brokers, the group that has taken credit for that leak, threatened on Tuesday to release more recent code to enable hackers to break into the world&#39;s most widely used computers, software and phones.

A blog post written by the group promised from June to release tools every month to anyone willing to pay for access to some of the tech world&#39;s biggest commercial secrets.

It also threatened to dump data from banks using the SWIFT international money transfer network and from Russian, Chinese, Iranian or North Korean nuclear and missile programs. &quot;More details in June,&quot; it promised.

The spread of the WannaCry attack - which encrypts a user&#39;s data and demands a &quot;ransom&quot; be paid electronically to free it up again - slowed to a trickle on Tuesday, with few, isolated examples being reported.

In Canada, the Universite de Montreal was hit, with 120 of the French-language university&rsquo;s 8,300 computers affected, according to a university spokeswoman.

There were no new, major incidents in the United States. Fewer than 10 US&nbsp;organisations have reported attacks to the Department of Homeland Security since Friday, a US&nbsp;official told reporters on Tuesday.

The attack has caused most damage in Russia, Taiwan, Ukraine and India, according to Czech security firm Avast.

The United States likely avoided greater harm as the attack targeted older versions of Microsoft&#39;s Windows operating system, and more US&nbsp;users have licensed, up-to-date, patched versions of the software, compared to other regions of the world.

The Department of Homeland Security began an &quot;aggressive awareness campaign&quot; to alert the tech industry to the importance of installing the patch that Microsoft issued in March that protected users from the vulnerability exploited by the attack, a US&nbsp;official working on the attack told Reuters.

Microsoft said on Tuesday it was aware of Shadow Brokers&#39; most recent claim and that its security teams monitor potential threats in order to &quot;help us prioritise and take appropriate action.&quot;

Microsoft President and Chief Legal Officer Brad Smith said earlier this week the WannaCry attack used elements stolen from the NSA. The US&nbsp;government has not commented directly on the matter.

North Korea link probed

Cyber security researchers around the world have said they have found evidence that could link North Korea with the WannaCry cyber attack.

A researcher from South Korea&#39;s Hauri Labs said on Tuesday their own findings matched those of Symantecand Kaspersky, who said on Monday that some code in an earlier version of the WannaCry software had also appeared in programs used by the Lazarus Group, identified by some researchers as a North Korea-run hacking operation.

&quot;It is similar to North Korea&#39;s backdoor malicious codes,&quot; said Simon Choi, a senior researcher with Hauri who has done extensive research into North Korea&#39;s hacking capabilities and advises South Korean police and National Intelligence Service.

Both Symantec and Kaspersky said it was too early to tell whether North Korea was involved in the attacks, based on the evidence that was published on Twitter by Google security researcher Neel Mehta.

FireEye, another large cyber security firm, said it was also investigating, but it was cautious about drawing a link to North Korea.

&quot;The similarities we see between malware linked to that group and WannaCry are not unique enough to be strongly suggestive of a common operator,&quot; FireEye researcher John Miller said.

US&nbsp;and European security officials told Reuters on condition of anonymity that it was too early to say who might be behind the attacks, but they did not rule out North Korea as a suspect.

The Lazarus hackers, acting for impoverished North Korea, have been more brazen in their pursuit of financial gain than others, and have been blamed for the theft of $81 million from the Bangladesh central bank, according to some cyber security firms. The United States accused it of being behind a cyber attack on Sony Pictures in 2014.

North Korea has denied being behind the Sony and banking attacks. North Korean officials were not immediately available for comment and its state media has been quiet about the matter.

No information to share

In China, foreign ministry spokeswoman Hua Chunying said she had no information to share, when asked about the origin of the attack and whether North Korea might be connected.

Several Asian countries have been affected by the malware, although the impact has not been as widespread as some had feared.

In Malaysia, cyber security firm LE Global Services said it identified 12 cases so far, including a large government-linked corporation, a government-linked investment firm and an insurance company. It did not name any of the entities.

&quot;We may not see the real picture yet, as companies are not mandated to disclose security breaches to authorities in Malaysia,&quot; said LE Global CEO Fong Choong Fook.

&quot;The real situation may be serious. In one of the cases, the attack was traced back to early April.&quot;

Vietnam&#39;s state media said on Tuesday more than 200 computers had been affected, but one of the country&#39;s leading anti virus companies, Bkav, later put the figure at 1,900.

Taiwan Power said that nearly 800 of its computers were affected, although these were used for administration, not for systems involved in electricity generation.

(Reuters)

The fast-spreading cyber extortion campaign has infected more than 300,000 computers worldwide

Governments turned their attention to a possible new wave of cyber threats after the group that leaked US hacking tools used to launch the global WannaCry "ransomware" attack warned it would release more malicious code. The fast-spreading cyber extortion campaign, which has infected more than 3,00,000 computers worldwide since Friday, eased for second day on Tuesday, but the identity and motive of its creators remain unknown. The attack includes elements that belong to the US National Security Agency and were leaked online last month. Shadow Brokers, the group that has taken credit for that leak, threatened on Tuesday to release more recent code to enable hackers to break into the world's most widely used computers, software and phones. A blog post written by the group promised from June to release tools every month to anyone willing to pay for access to some of the tech world's biggest commercial secrets. It also threatened to dump data from banks using the SWIFT international money transfer network and from Russian, Chinese, Iranian or North Korean nuclear and missile programs. "More details in June," it promised. The spread of the WannaCry attack - which encrypts a user's data and demands a "ransom" be paid electronically to free it up again - slowed to a trickle on Tuesday, with few, isolated examples being reported. In Canada, the Universite de Montreal was hit, with 120 of the French-language university’s 8,300 computers affected, according to a university spokeswoman. There were no new, major incidents in the United States. Fewer than 10 US organisations have reported attacks to the Department of Homeland Security since Friday, a US official told reporters on Tuesday. The attack has caused most damage in Russia, Taiwan, Ukraine and India, according to Czech security firm Avast. The United States likely avoided greater harm as the attack targeted older versions of Microsoft's Windows operating system, and more US users have licensed, up-to-date, patched versions of the software, compared to other regions of the world. The Department of Homeland Security began an "aggressive awareness campaign" to alert the tech industry to the importance of installing the patch that Microsoft issued in March that protected users from the vulnerability exploited by the attack, a US official working on the attack told Reuters. Microsoft said on Tuesday it was aware of Shadow Brokers' most recent claim and that its security teams monitor potential threats in order to "help us prioritise and take appropriate action." Microsoft President and Chief Legal Officer Brad Smith said earlier this week the WannaCry attack used elements stolen from the NSA. The US government has not commented directly on the matter. North Korea link probed Cyber security researchers around the world have said they have found evidence that could link North Korea with the WannaCry cyber attack. A researcher from South Korea's Hauri Labs said on Tuesday their own findings matched those of Symantecand Kaspersky, who said on Monday that some code in an earlier version of the WannaCry software had also appeared in programs used by the Lazarus Group, identified by some researchers as a North Korea-run hacking operation. "It is similar to North Korea's backdoor malicious codes," said Simon Choi, a senior researcher with Hauri who has done extensive research into North Korea's hacking capabilities and advises South Korean police and National Intelligence Service. Both Symantec and Kaspersky said it was too early to tell whether North Korea was involved in the attacks, based on the evidence that was published on Twitter by Google security researcher Neel Mehta. FireEye, another large cyber security firm, said it was also investigating, but it was cautious about drawing a link to North Korea. "The similarities we see between malware linked to that group and WannaCry are not unique enough to be strongly suggestive of a common operator," FireEye researcher John Miller said. US and European security officials told Reuters on condition of anonymity that it was too early to say who might be behind the attacks, but they did not rule out North Korea as a suspect. The Lazarus hackers, acting for impoverished North Korea, have been more brazen in their pursuit of financial gain than others, and have been blamed for the theft of $81 million from the Bangladesh central bank, according to some cyber security firms. The United States accused it of being behind a cyber attack on Sony Pictures in 2014. North Korea has denied being behind the Sony and banking attacks. North Korean officials were not immediately available for comment and its state media has been quiet about the matter. No information to share In China, foreign ministry spokeswoman Hua Chunying said she had no information to share, when asked about the origin of the attack and whether North Korea might be connected. Several Asian countries have been affected by the malware, although the impact has not been as widespread as some had feared. In Malaysia, cyber security firm LE Global Services said it identified 12 cases so far, including a large government-linked corporation, a government-linked investment firm and an insurance company. It did not name any of the entities. "We may not see the real picture yet, as companies are not mandated to disclose security breaches to authorities in Malaysia," said LE Global CEO Fong Choong Fook. "The real situation may be serious. In one of the cases, the attack was traced back to early April." Vietnam's state media said on Tuesday more than 200 computers had been affected, but one of the country's leading anti virus companies, Bkav, later put the figure at 1,900. Taiwan Power said that nearly 800 of its computers were affected, although these were used for administration, not for systems involved in electricity generation. (Reuters)

WannaCry: Cyber attack eases, but hacking group threatens to sell code

malware-attacks

Malware Attacks, News on Malware Attacks, stories on Malware Attacks, articles on Malware Attacks, Malware Attacks stories at Wion, Malware Attacks news, Malware Attacks latest news

malware attacks

Global police shut down largest malware group 'targeting millions': EU judicial arm

Explained: 'Harly' the latest malware in market, that can drain your bank accounts

Chinese hackers target foreign government officials using a new malware

WannaCry: Security experts find clues to ransomware worm's lingering risks

WannaCry: Cyber attack eases, but hacking group threatens to sell code