Hackers are stepping up attacks on health care systems with ransomware in the United States and other countries, creating new risks for medical care as the global coronavirus pandemic accelerates.&nbsp;

Alerts from US authorities and security researchers highlight a wave of cyberattacks on hospitals coping with rising virus infections.

An unusual warning this week from the FBI with the Departments of Homeland Security and Health and Human Services, underscored the threat.

The three agencies "have credible information of an increased and imminent cybercrime threat to US hospitals and health care providers," said the alert issued Wednesday, calling on health systems to "take timely and reasonable precautions to protect their networks from these threats."

Media reports have cited several US hospitals hit by ransomware.&nbsp;

One of them, the University of Vermont Medical Center, said in a statement Thursday it was working with law enforcement on "a now confirmed cyberattack that has affected some of our systems" which has had "variable impacts" on patient care.

Daniel dos Santos of the computer security firm Forescout said cash-strapped medical centers are particularly attractive targets for hackers and that at least 400 hospitals had been hit in the past few weeks in the US and Britain.

Hackers are aware that "health care is the most likely to pay the ransom because their services are critical," dos Santos said.

"Stopping services means that people will literally be dying."

For hospitals unable or willing to pay, "it would mean going back to pen and paper, which can cause huge slowdowns," he added.

Forescout said in a report that while many hospitals have upgraded computer systems, most use a variety of connected devices such as patient monitors or CT scanners which "act as the weak links in the network" because they transmit data over insecure channels.

In one sign of the troubles looming, dos Santos and fellow researchers said they discovered data on some three million US patients online, "unprotected and accessible to anyone who knows how to search for it.," the Forescout report said.

- Most targeted -

Ransomware is a longstanding security issue and health care has been a frequent target. A September attack disrupted Universal Health Services, which operates hospitals in the US and Britain.

But security experts say the attacks are accelerating as the pandemic worsens.

Researchers at the security firm Check Point said its survey showed health care has been the most targeted industry by ransomware, with a 71 percent jump in attacks on US providers in October from a month earlier.

Check Point said there have been significant rises in ransomware attacks on hospitals in Asia, Europe and the Middle East as well. Globally, the firm said ransomware attacks were up 50 percent in the third quarter compared with the first half of this year.

Many of the attacks use a strain of ransomware known as Ryuk, which security researchers say may be tied to North Korean or Russian cybercriminals.

The US government warning said health organizations are being targeted by phishing attacks to get access to the systems, with hackers using sophisticated tools including TrickBot software which can harvest credentials and exfiltrate data.

The Canadian government's Cyber Centre issued a similar warning in early October, warning of Ryuk ransomware "affecting multiple entities, including municipal governments and public health and safety organizations in Canada and abroad."

"The ransomware problem is&nbsp;steadily worsening and a solution desperately needs to be found," said Brett Callow of the security firm Emsisoft.

"We believe that solution is a prohibition on the payment of demands. Ransomware exists only because it's profitable. If the flow of cash stops, the attacks will stop and hospitals will no longer be at risk."

Hackers are stepping up attacks on health care systems with ransomware in the United States and other countries, creating new risks for medical care as the global coronavirus pandemic accelerates.

Hackers are stepping up attacks on health care systems with ransomware in the United States and other countries, creating new risks for medical care as the global coronavirus pandemic accelerates. Alerts from US authorities and security researchers highlight a wave of cyberattacks on hospitals coping with rising virus infections. An unusual warning this week from the FBI with the Departments of Homeland Security and Health and Human Services, underscored the threat. The three agencies "have credible information of an increased and imminent cybercrime threat to US hospitals and health care providers," said the alert issued Wednesday, calling on health systems to "take timely and reasonable precautions to protect their networks from these threats." Media reports have cited several US hospitals hit by ransomware. One of them, the University of Vermont Medical Center, said in a statement Thursday it was working with law enforcement on "a now confirmed cyberattack that has affected some of our systems" which has had "variable impacts" on patient care. Daniel dos Santos of the computer security firm Forescout said cash-strapped medical centers are particularly attractive targets for hackers and that at least 400 hospitals had been hit in the past few weeks in the US and Britain. Hackers are aware that "health care is the most likely to pay the ransom because their services are critical," dos Santos said. "Stopping services means that people will literally be dying." For hospitals unable or willing to pay, "it would mean going back to pen and paper, which can cause huge slowdowns," he added. Forescout said in a report that while many hospitals have upgraded computer systems, most use a variety of connected devices such as patient monitors or CT scanners which "act as the weak links in the network" because they transmit data over insecure channels. In one sign of the troubles looming, dos Santos and fellow researchers said they discovered data on some three million US patients online, "unprotected and accessible to anyone who knows how to search for it.," the Forescout report said. - Most targeted - Ransomware is a longstanding security issue and health care has been a frequent target. A September attack disrupted Universal Health Services, which operates hospitals in the US and Britain. But security experts say the attacks are accelerating as the pandemic worsens. Researchers at the security firm Check Point said its survey showed health care has been the most targeted industry by ransomware, with a 71 percent jump in attacks on US providers in October from a month earlier. Check Point said there have been significant rises in ransomware attacks on hospitals in Asia, Europe and the Middle East as well. Globally, the firm said ransomware attacks were up 50 percent in the third quarter compared with the first half of this year. Many of the attacks use a strain of ransomware known as Ryuk, which security researchers say may be tied to North Korean or Russian cybercriminals. The US government warning said health organizations are being targeted by phishing attacks to get access to the systems, with hackers using sophisticated tools including TrickBot software which can harvest credentials and exfiltrate data. The Canadian government's Cyber Centre issued a similar warning in early October, warning of Ryuk ransomware "affecting multiple entities, including municipal governments and public health and safety organizations in Canada and abroad." "The ransomware problem is steadily worsening and a solution desperately needs to be found," said Brett Callow of the security firm Emsisoft. "We believe that solution is a prohibition on the payment of demands. Ransomware exists only because it's profitable. If the flow of cash stops, the attacks will stop and hospitals will no longer be at risk."

Ransomware surge imperils hospitals as pandemic intensifies

Operations at one of three terminals at India&#39;s largest container port JNPT, on the outskirts of India&#39;s commercial hub of Mumbai, have been disrupted by the global ransomware attack.

The terminal impacted is operated by Danish shipping giant AP Moller-Maersk, which said that the cyberattack had caused outages in its computer systems globally.

The attack, similar to the ransomware that infected more than 3,00,000 computers last month, also affected computers at Russia&#39;s biggest oil company, Ukranian banks, and multinational firms.

The Indian port has been trying to clear containers manually, but operational capacity has dropped to a third at the terminal, Anil Diggikar, Chairman of Jawaharlal Nehru Port (JNPT), told.&nbsp;

&quot;This is fallout of global cyber attack. We are hopeful that operations will normalise in a day,&quot; he said. &quot;Containers are piling up outside the port due to delay in loading and unloading at Gateway Terminals India.&quot;

The terminal impacted is operated by Danish shipping giant AP Moller-Maersk

Operations at one of three terminals at India's largest container port JNPT, on the outskirts of India's commercial hub of Mumbai, have been disrupted by the global ransomware attack. The terminal impacted is operated by Danish shipping giant AP Moller-Maersk, which said that the cyberattack had caused outages in its computer systems globally. The attack, similar to the ransomware that infected more than 3,00,000 computers last month, also affected computers at Russia's biggest oil company, Ukranian banks, and multinational firms. The Indian port has been trying to clear containers manually, but operational capacity has dropped to a third at the terminal, Anil Diggikar, Chairman of Jawaharlal Nehru Port (JNPT), told. "This is fallout of global cyber attack. We are hopeful that operations will normalise in a day," he said. "Containers are piling up outside the port due to delay in loading and unloading at Gateway Terminals India."

India's largest container port hit by global cyber attack

As the &ldquo;<a href="https://twitter.com/kaspersky/status/879749175570817024">NotPetya</a>&rdquo; ransomware attack <a href="https://www.nytimes.com/2017/06/27/technology/ransomware-hackers.html">spreads around the world</a>, it&rsquo;s making clear how important it is for everyone &ndash; and particularly corporations &ndash; to take cybersecurity seriously. The <a href="https://www.forbes.com/sites/thomasbrewster/2017/06/27/petya-notpetya-ransomware-is-more-powerful-than-wannacry/">companies affected by this malware</a> include <a href="https://www.usatoday.com/story/tech/news/2017/06/27/large-cyberattack-hits-europe-disrupts-power-grid-banks/103226268/">power utilities, banks and technology firms</a>. Their customers are now left without power and other crucial services, in part because the companies did not take action and make the investments necessary to better protect themselves from these cyberattacks.

Cybersecurity is becoming another facet of the growing movement demanding <a href="http://csr-asia.com/csr-asia-weekly-news-detail.php?id=12692">corporate social responsibility</a>. This broad effort has already made progress toward getting workers paid a <a href="https://www.ecotextile.com/2016051922130/social-compliance-csr-news/living-wage-from-clothing-premium.html">living wage</a>, encouraging companies to operate <a href="http://www.triplepundit.com/2017/01/10-companies-zero-waste-to-landfill/">zero-waste production plants</a> and practice <a href="http://greenlivingideas.com/2015/08/31/cradle-to-cradle-manufacturing/">cradle-to-cradle manufacturing</a> &ndash; and even getting them to <a href="http://www.cnbc.com/2017/06/16/toms-founder-blake-mycoskie-shares-his-favorite-book-of-all-time.html">donate products</a> to people in need.

The overall idea is that companies should make corporate decisions that reflect obligations not just to owners and shareholders, customers and employees, but to society at large and the natural environment. As a scholar of cybersecurity law and policy and chair of Indiana University&rsquo;s new integrated program on <a href="https://cybersecurityprograms.indiana.edu/">cybersecurity risk management</a>, I say it&rsquo;s time to add cyberspace to that list.

Online security affects everyone

The recent <a href="http://www.bbc.com/news/technology-40085241">WannaCry ransomware attack</a> affected more than 200,000 computers in <a href="https://www.bleepingcomputer.com/news/security/new-data-shows-most-wannacry-victims-are-from-china-not-russia/">150 nations</a>. The results of the attack made clear that computers whose <a href="https://theconversation.com/why-installing-software-updates-makes-us-wannacry-77667">software is not kept up to date</a> can hurt not only the computers&rsquo; owners, but ultimately all internet users. The companies hit by the NotPetya attack didn&rsquo;t heed that warning, and got caught by an attack <a href="https://www.wired.com/story/petya-ransomware-outbreak-eternal-blue/">using the same vulnerability as WannaCry</a>, because they still haven&rsquo;t updated their systems.

Some policymakers and managers are taking notice <a href="http://www.chinadailyasia.com/opinion/2016-09/11/content_15493388.html">around the world</a>. In the U.S., the Department of Homeland Security, the <a href="https://www.dhs.gov/topic/cybersecurity">chief federal agency dealing with cybersecurity</a>, has highlighted businesses&rsquo; &ldquo;<a href="https://www.dhs.gov/blog/2013/10/18/cybersecurity-shared-responsibility">shared responsibility</a>&rdquo; to <a href="https://www.dhs.gov/blog/2013/10/18/cybersecurity-shared-responsibility">protect themselves</a> against cyberattacks. Consumers can&rsquo;t protect their utility services, banking systems or even their personal data on their own, and must depend on companies to handle that security.

Cybersecurity is an effort that not only protects &ndash; and even benefits &ndash; a company&rsquo;s bottom line but also contributes to overall <a href="http://www.huffingtonpost.com/scott-j-shackelford/sustainable-cybersecurity_b_6988050.html">corporate and societal sustainability</a>. In addition, by protecting privacy, free expression and the exchange of information, cybersecurity helps support people&rsquo;s <a href="https://theconversation.com/should-cybersecurity-be-a-human-right-72342">human rights</a>, both online and offline.

Vaccinating cyberspace

If more companies get serious about cybersecurity, the internet ecosystem will be safer for everyone. The concept is much like vaccinating people against disease: <a href="https://www.vaccines.gov/basics/protection/index.html">If enough people are protected, the others benefit too</a>, through what is called &ldquo;<a href="https://theconversation.com/herd-immunity-and-measles-why-we-should-aim-for-100-vaccination-coverage-36868">herd immunity</a>.&rdquo;

In terms of deterring hackers, the number of vulnerable targets will drop, making it harder for hackers to find them, and less worthwhile to even look. And more companies will have defenses ready when cyber attackers come calling. This isn&rsquo;t a perfect solution: With enough time and resources, any system is vulnerable. But this change in corporate perception is an important step in developing a global <a href="http://www.cambridge.org/us/academic/subjects/law/e-commerce-law/managing-cyber-attacks-international-law-business-and-relations-search-cyber-peace?format=HB&amp;isbn=9781107004375">culture of cybersecurity</a>.

Customers can get involved in this effort, demanding better cybersecurity from companies they do business with. These can include online retailers, whether small specialized sellers or giants like Amazon. But local bricks-and-mortar stores with customer loyalty programs that have built their brands on trust can also be susceptible to consumer pressure.

To date, it&rsquo;s been hard to know which companies have the best cybersecurity practices. The product and service reviewers at Consumer Reports have made a start: In March they started <a href="http://www.consumerreports.org/privacy/consumer-reports-to-begin-evaluating-products-services-for-privacy-and-data-security/">evaluating devices, software and mobile apps</a> for privacy and cybersecurity.

Advocacy groups like the <a href="http://www.internetsociety.org/">Internet Society</a> <a href="http://www.cyberpeacefoundation.org/">and</a> <a href="https://staysafeonline.org/">many</a> <a href="https://www.comptia.org/advocacy">others</a> should ask companies to discuss cybersecurity efforts in their reports to shareholders. And they should urge government agencies to develop voluntary programs like the <a href="https://www.energystar.gov/">U.S. Environmental Protection Agency&rsquo;s Energy Star</a> appliance-efficiency rating system. The U.K. has a certification like this for cybersecurity, called <a href="https://www.cyberessentials.org/">Cyber Essentials</a>. These efforts don&rsquo;t require executives or managers to make different decisions, but help inform them &ndash; and the public &ndash; about how the choices they make affect consumers.

<img alt="The Conversation" height="1" src="https://counter.theconversation.edu.au/content/79810/count.gif?distributor=republish-lightbox-basic" width="1" />Ultimately, companies will play a huge role in shaping the future of our shared experience online. Cybersecurity and data privacy are key elements of this, and it&rsquo;s time consumers demand corporations treat them as the 21st-century social responsibilities they are.

&nbsp;

This article was originally published on <a href="http://theconversation.com">The Conversation</a>. Read the <a href="https://theconversation.com/notpetya-ransomware-attack-shows-corporate-social-responsibility-should-include-cybersecurity-79810">original article</a>.

Computers whose software is not kept up to date can hurt not only the computers? owners, but ultimately all internet users

As the “NotPetya” ransomware attack spreads around the world, it’s making clear how important it is for everyone – and particularly corporations – to take cybersecurity seriously. The companies affected by this malware include power utilities, banks and technology firms. Their customers are now left without power and other crucial services, in part because the companies did not take action and make the investments necessary to better protect themselves from these cyberattacks. Cybersecurity is becoming another facet of the growing movement demanding corporate social responsibility. This broad effort has already made progress toward getting workers paid a living wage, encouraging companies to operate zero-waste production plants and practice cradle-to-cradle manufacturing – and even getting them to donate products to people in need. The overall idea is that companies should make corporate decisions that reflect obligations not just to owners and shareholders, customers and employees, but to society at large and the natural environment. As a scholar of cybersecurity law and policy and chair of Indiana University’s new integrated program on cybersecurity risk management, I say it’s time to add cyberspace to that list. Online security affects everyone The recent WannaCry ransomware attack affected more than 200,000 computers in 150 nations. The results of the attack made clear that computers whose software is not kept up to date can hurt not only the computers’ owners, but ultimately all internet users. The companies hit by the NotPetya attack didn’t heed that warning, and got caught by an attack using the same vulnerability as WannaCry, because they still haven’t updated their systems. Some policymakers and managers are taking notice around the world. In the U.S., the Department of Homeland Security, the chief federal agency dealing with cybersecurity, has highlighted businesses’ “shared responsibility” to protect themselves against cyberattacks. Consumers can’t protect their utility services, banking systems or even their personal data on their own, and must depend on companies to handle that security. Cybersecurity is an effort that not only protects – and even benefits – a company’s bottom line but also contributes to overall corporate and societal sustainability. In addition, by protecting privacy, free expression and the exchange of information, cybersecurity helps support people’s human rights, both online and offline. Vaccinating cyberspace If more companies get serious about cybersecurity, the internet ecosystem will be safer for everyone. The concept is much like vaccinating people against disease: If enough people are protected, the others benefit too, through what is called “herd immunity.” In terms of deterring hackers, the number of vulnerable targets will drop, making it harder for hackers to find them, and less worthwhile to even look. And more companies will have defenses ready when cyber attackers come calling. This isn’t a perfect solution: With enough time and resources, any system is vulnerable. But this change in corporate perception is an important step in developing a global culture of cybersecurity. Customers can get involved in this effort, demanding better cybersecurity from companies they do business with. These can include online retailers, whether small specialized sellers or giants like Amazon. But local bricks-and-mortar stores with customer loyalty programs that have built their brands on trust can also be susceptible to consumer pressure. To date, it’s been hard to know which companies have the best cybersecurity practices. The product and service reviewers at Consumer Reports have made a start: In March they started evaluating devices, software and mobile apps for privacy and cybersecurity. Advocacy groups like the Internet Society and many others should ask companies to discuss cybersecurity efforts in their reports to shareholders. And they should urge government agencies to develop voluntary programs like the U.S. Environmental Protection Agency’s Energy Star appliance-efficiency rating system. The U.K. has a certification like this for cybersecurity, called Cyber Essentials. These efforts don’t require executives or managers to make different decisions, but help inform them – and the public – about how the choices they make affect consumers. Ultimately, companies will play a huge role in shaping the future of our shared experience online. Cybersecurity and data privacy are key elements of this, and it’s time consumers demand corporations treat them as the 21st-century social responsibilities they are. This article was originally published on The Conversation. Read the original article.

'Petya' ransomware attack shows corporate social responsibility should include cybersecurity

A major global cyber attack on Tuesday disrupted computers at Russia&#39;s biggest oil company, Ukrainian banks and multinational firms with a virus similar to the ransomware that last month infected more than 3,00,000 computers.

The rapidly spreading cyber extortion campaign underscored growing concerns that businesses have failed to secure their networks from increasingly aggressive hackers, who have shown they are capable of shutting down critical infrastructure and crippling corporate and government networks.

It included code known as &quot;Eternal Blue,&quot; which cyber security experts widely believe was stolen from the US National Security Agency (NSA) and was also used in last month&#39;s ransomware attack, named &quot;WannaCry.&quot;

&quot;Cyber attacks can simply destroy us,&quot; said Kevin Johnson, chief executive of cyber security firm Secure Ideas. &quot;Companies are just not doing what they are supposed to do to fix the problem.&quot;

The ransomware virus crippled computers running Microsoft&#39;s Windows by encrypting hard drives and overwriting files, then demanded $300 in bitcoin payments to restore access. More than 30 victims paid into the bitcoin account associated with the attack, according to a public ledger of transactions listed on blockchain.info.

Microsoft said the virus could spread through a flaw that was patched in a security update in March.

&quot;We are continuing to investigate and will take appropriate action to protect customers,&quot; a spokesman for the company said, adding that Microsoft antivirus software detects and removes it.

Russia and Ukraine were most affected by the thousands of attacks, according to security software maker Kaspersky Lab, with other victims spread across countries including Britain, France, Germany, Italy, Poland and the United States. The total number of attacks was unknown.

Security experts said they expected the impact to be smaller than WannaCry since many computers had been patched with Windows updates in the wake of WannaCry last month to protect them against attacks using Eternal Blue code.

Still, the attack could be more dangerous than traditional strains of ransomware because it makes computers unresponsive and unable to reboot, Juniper Networks said in a blog post analysing the attack.

Researchers said the attack may have borrowed malware code used in earlier ransomware campaigns known as &quot;Petya&quot; and &quot;GoldenEye.&quot;

Following last month&#39;s attack, governments, security firms and industrial groups aggressively advised businesses and consumers to make sure all their computers were updated with Microsoft patches to defend against the threat.

The US Department of Homeland Security said it was monitoring the attacks and coordinating with other countries. It advised victims not to pay the extortion, saying that doing so does not guarantee access will be restored.

In a statement, the White House National Security Council said there was currently no risk to public safety. The United States was investigating the attack and determined to hold those responsible accountable, it said.

The NSA did not respond to a request for comment. The spy agency has not publicly said whether it built Eternal Blue and other hacking tools leaked online by an entity known as Shadow Brokers.

Several private security experts have said they believe Shadow Brokers is tied to the Russian government, and that the North Korean government was behind WannaCry. Both countries&#39; governments deny charges they are involved in hacking.

&lsquo;Don&rsquo;t waste your time&rsquo;

The first attacks were reported from Russia and Ukraine.

Russia&#39;s Rosneft, one of the world&#39;s biggest crude producers by volume, said its systems had suffered &quot;serious consequences,&quot; but added oil production had not been affected because it switched over to backup systems.

Ukrainian Deputy Prime Minister Pavlo Rozenko said the government&#39;s computer network went down and the central bank reported disruption to operations at banks and firms including the state power distributor.

Danish shipping giant AP Moller-Maersk said it was among the victims, reporting outages at facilities including its Los Angeles terminal.

WPP, the world&#39;s largest advertising agency, said it was also infected. A WPP employee who asked not to be named said that workers were told to shut down their computers: &quot;The building has come to a standstill.&quot;

A Ukrainian media company said its computers were blocked and it was asked to pay $300 in the crypto-currency bitcoin to regain access.

&quot;Perhaps you are busy looking for a way to recover your files, but don&#39;t waste your time. Nobody can recover your files without our decryption service,&quot; the message said, according to a screenshot posted on Ukraine&#39;s Channel 24.

Russia&#39;s central bank said there were isolated cases of lenders&#39; IT systems being infected. One consumer lender, Home Credit, had to suspend client operations.

Other companies that identified themselves as victims included French construction materials firm Saint Gobain, US drugmaker Merck &amp; Co and Mars Inc&#39;s Royal Canin pet food business.

India-based employees at Beiersdorf, makers of Nivea skin care products, and Reckitt Benckiser, which owns Enfamil and Lysol, told Reuters the ransomware attack had impacted some of their systems in the country.

Western Pennsylvania&#39;s Heritage Valley Health System&#39;s entire network was shut down by a cyber attack on Tuesday, according to local media reports.

Last&#39;s month&#39;s fast-spreading WannaCry ransomware attack was crippled after a 22-year-old British security researcher Marcus Hutchins created a so-called &quot;kill switch&quot; that experts hailed as the decisive step in slowing the attack.

Security experts said they did not believe that the ransomware released on Tuesday had a kill switch, meaning that it might be harder to stop.

Ukraine&#39;s cyber police said on Twitter that a vulnerability in software used by MEDoc, a Ukrainian accounting firm, may have been an initial source of the virus, which researchers including cyber intelligence firm Flashpoint said could have infected victims via an illegitimate software update.

In a Facebook post, MEDoc confirmed it had been hacked but denied responsibility for originating the attack. 
An adviser to Ukraine&#39;s interior minister said earlier in the day that the virus got into computer systems via &quot;phishing&quot; emails written in Russian and Ukrainian designed to lure employees into opening them.

According to the state security agency, the emails contained infected Word documents or PDF files as attachments.

&nbsp;

The rapidly spreading cyber extortion campaign underscores growing concerns that businesses have failed to secure their networks

A major global cyber attack on Tuesday disrupted computers at Russia's biggest oil company, Ukrainian banks and multinational firms with a virus similar to the ransomware that last month infected more than 3,00,000 computers. The rapidly spreading cyber extortion campaign underscored growing concerns that businesses have failed to secure their networks from increasingly aggressive hackers, who have shown they are capable of shutting down critical infrastructure and crippling corporate and government networks. It included code known as "Eternal Blue," which cyber security experts widely believe was stolen from the US National Security Agency (NSA) and was also used in last month's ransomware attack, named "WannaCry." "Cyber attacks can simply destroy us," said Kevin Johnson, chief executive of cyber security firm Secure Ideas. "Companies are just not doing what they are supposed to do to fix the problem." The ransomware virus crippled computers running Microsoft's Windows by encrypting hard drives and overwriting files, then demanded $300 in bitcoin payments to restore access. More than 30 victims paid into the bitcoin account associated with the attack, according to a public ledger of transactions listed on blockchain.info. Microsoft said the virus could spread through a flaw that was patched in a security update in March. "We are continuing to investigate and will take appropriate action to protect customers," a spokesman for the company said, adding that Microsoft antivirus software detects and removes it. Russia and Ukraine were most affected by the thousands of attacks, according to security software maker Kaspersky Lab, with other victims spread across countries including Britain, France, Germany, Italy, Poland and the United States. The total number of attacks was unknown. Security experts said they expected the impact to be smaller than WannaCry since many computers had been patched with Windows updates in the wake of WannaCry last month to protect them against attacks using Eternal Blue code. Still, the attack could be more dangerous than traditional strains of ransomware because it makes computers unresponsive and unable to reboot, Juniper Networks said in a blog post analysing the attack. Researchers said the attack may have borrowed malware code used in earlier ransomware campaigns known as "Petya" and "GoldenEye." Following last month's attack, governments, security firms and industrial groups aggressively advised businesses and consumers to make sure all their computers were updated with Microsoft patches to defend against the threat. The US Department of Homeland Security said it was monitoring the attacks and coordinating with other countries. It advised victims not to pay the extortion, saying that doing so does not guarantee access will be restored. In a statement, the White House National Security Council said there was currently no risk to public safety. The United States was investigating the attack and determined to hold those responsible accountable, it said. The NSA did not respond to a request for comment. The spy agency has not publicly said whether it built Eternal Blue and other hacking tools leaked online by an entity known as Shadow Brokers. Several private security experts have said they believe Shadow Brokers is tied to the Russian government, and that the North Korean government was behind WannaCry. Both countries' governments deny charges they are involved in hacking. ‘Don’t waste your time’ The first attacks were reported from Russia and Ukraine. Russia's Rosneft, one of the world's biggest crude producers by volume, said its systems had suffered "serious consequences," but added oil production had not been affected because it switched over to backup systems. Ukrainian Deputy Prime Minister Pavlo Rozenko said the government's computer network went down and the central bank reported disruption to operations at banks and firms including the state power distributor. Danish shipping giant AP Moller-Maersk said it was among the victims, reporting outages at facilities including its Los Angeles terminal. WPP, the world's largest advertising agency, said it was also infected. A WPP employee who asked not to be named said that workers were told to shut down their computers: "The building has come to a standstill." A Ukrainian media company said its computers were blocked and it was asked to pay $300 in the crypto-currency bitcoin to regain access. "Perhaps you are busy looking for a way to recover your files, but don't waste your time. Nobody can recover your files without our decryption service," the message said, according to a screenshot posted on Ukraine's Channel 24. Russia's central bank said there were isolated cases of lenders' IT systems being infected. One consumer lender, Home Credit, had to suspend client operations. Other companies that identified themselves as victims included French construction materials firm Saint Gobain, US drugmaker Merck & Co and Mars Inc's Royal Canin pet food business. India-based employees at Beiersdorf, makers of Nivea skin care products, and Reckitt Benckiser, which owns Enfamil and Lysol, told Reuters the ransomware attack had impacted some of their systems in the country. Western Pennsylvania's Heritage Valley Health System's entire network was shut down by a cyber attack on Tuesday, according to local media reports. Last's month's fast-spreading WannaCry ransomware attack was crippled after a 22-year-old British security researcher Marcus Hutchins created a so-called "kill switch" that experts hailed as the decisive step in slowing the attack. Security experts said they did not believe that the ransomware released on Tuesday had a kill switch, meaning that it might be harder to stop. Ukraine's cyber police said on Twitter that a vulnerability in software used by MEDoc, a Ukrainian accounting firm, may have been an initial source of the virus, which researchers including cyber intelligence firm Flashpoint said could have infected victims via an illegitimate software update. In a Facebook post, MEDoc confirmed it had been hacked but denied responsibility for originating the attack. An adviser to Ukraine's interior minister said earlier in the day that the virus got into computer systems via "phishing" emails written in Russian and Ukrainian designed to lure employees into opening them. According to the state security agency, the emails contained infected Word documents or PDF files as attachments.

New cyber attack, similar to 'WannaCry', sweeps globe - once again

For Kris Hagerman, chief executive of UK-based cyber security firm Sophos Group, the past week could have been bad. The WannaCry &quot;ransomware&quot; attack hobbled some of its hospital customers in Britain&#39;s National Health Service, forcing them to turn away ambulances and cancel surgeries.

The company quickly removed a boast on its website that &ldquo;The NHS is totally protected with Sophos.&rdquo; In many industries, that sort of stumble would likely hit a company&#39;s reputation hard.

Yet on Monday, three days after the global malware attack was first detected, Sophos stock jumped more than 7 per cent to set a record high and climbed further on Wednesday after the company raised its financial forecasts.

As for most other cyber security firms, highly publicized cyber attacks are good for business, even though experts say such attacks underscore the industry&#39;s failings.

&quot;We are making good progress and are doing a good job,&quot; Hagerman said in an interview this week. &quot;People ask &#39;How come you haven&rsquo;t solved the cyber crime problem?&#39; and it&#39;s a little like saying &#39;You human beings have been around for hundreds of thousands of years, how come you haven&#39;t solved the crime problem?&#39;&quot;

Hagerman pointed out that his company only claimed to protect 60 per cent of NHS affiliates and that other factors contributed to the disaster at the hospitals.

&quot;They have their own budgets. They have their own approach to IT generally and IT security,&rdquo; Hagerman said of individual hospitals, which pick their own operating systems, patching cycles and network setups. Microsoft had issued a patch in March for the flaw WannaCry exploited in Windows operating systems.

Yet Hagerman acknowledged that Sophos did not update its basic antivirus software to block WannaCry until hours after it hit customers.

High stakes

Security experts say hospitals, where the stakes are especially high, represent a case study in how legacy industries need to up their cyber security game.

&quot;We&#39;ve tolerated a pretty poor level of effectiveness, because so far the consequences of failure have been acceptable,&quot; said Josh Corman, a cyber security industry veteran now working on related issues at the Atlantic Council and a member of a healthcare security task force established by the US&nbsp;Congress.

&quot;We are going to see failure measured in loss of life and a hit to GDP, and people will be very surprised.&quot;

Some long-lived medical devices have more than a thousand vulnerabilities, Corman said, and perhaps 85 per cent of US&nbsp;medical institutions have no staff qualified for basic cyber security tasks such as patching software, monitoring threat advisories and separating networks from one another.

Increasingly serious cyber security problems are partly an inevitable consequence of the growing complexity of digital technology.

But there are other causes too, including a lack of accountability that stems from the wide range of technology handlers: computer software vendors, antivirus suppliers, in-house professionals, consultants and various regulators.

Ultimately, Corman said, hospitals need to hire solid cyber security people instead of another nurse or two.

Good for business

&quot;What&rsquo;s needed is punishment of the negligent,&quot; said Ross Anderson, a University of Cambridge pioneer in studying the economics of information security, referring to the hospitals that did not stop WannaCry.

&quot;This is not about technology. This is about people fouling up in ways people would get a pink slip for&rdquo; in less-insulated environments, he said, meaning they would lose their jobs.

For now, though, there are few signs of any revamp in large institutions&#39; approach to cyber security - and little incentive for contractors in the cyber security industry to change.

Sophos was not the only company whose stock rose on Monday, as the global scale of WannaCry became apparent. Shares of US-based FireEye&nbsp;and Qualys&nbsp;both rose more than 5 per cent.

But Sophos stood out, aided by higher expectations for a product the company introduced last year to fend off ransomware - so called because the authors of the malware demand a &#39;ransom&#39; to restore a user&#39;s infected computer - which worked at the hospitals that had installed it.

&quot;It&#39;s good news for our business,&quot; one Sophos employee, who asked not to be named, told Reuters this week. &quot;We were so inundated with people calling us.&quot;

(Reuters)

Stocks of cyber security firms rise as the global scale of WannaCry becomes apparent

For Kris Hagerman, chief executive of UK-based cyber security firm Sophos Group, the past week could have been bad. The WannaCry "ransomware" attack hobbled some of its hospital customers in Britain's National Health Service, forcing them to turn away ambulances and cancel surgeries. The company quickly removed a boast on its website that “The NHS is totally protected with Sophos.” In many industries, that sort of stumble would likely hit a company's reputation hard. Yet on Monday, three days after the global malware attack was first detected, Sophos stock jumped more than 7 per cent to set a record high and climbed further on Wednesday after the company raised its financial forecasts. As for most other cyber security firms, highly publicized cyber attacks are good for business, even though experts say such attacks underscore the industry's failings. "We are making good progress and are doing a good job," Hagerman said in an interview this week. "People ask 'How come you haven’t solved the cyber crime problem?' and it's a little like saying 'You human beings have been around for hundreds of thousands of years, how come you haven't solved the crime problem?'" Hagerman pointed out that his company only claimed to protect 60 per cent of NHS affiliates and that other factors contributed to the disaster at the hospitals. "They have their own budgets. They have their own approach to IT generally and IT security,” Hagerman said of individual hospitals, which pick their own operating systems, patching cycles and network setups. Microsoft had issued a patch in March for the flaw WannaCry exploited in Windows operating systems. Yet Hagerman acknowledged that Sophos did not update its basic antivirus software to block WannaCry until hours after it hit customers. High stakes Security experts say hospitals, where the stakes are especially high, represent a case study in how legacy industries need to up their cyber security game. "We've tolerated a pretty poor level of effectiveness, because so far the consequences of failure have been acceptable," said Josh Corman, a cyber security industry veteran now working on related issues at the Atlantic Council and a member of a healthcare security task force established by the US Congress. "We are going to see failure measured in loss of life and a hit to GDP, and people will be very surprised." Some long-lived medical devices have more than a thousand vulnerabilities, Corman said, and perhaps 85 per cent of US medical institutions have no staff qualified for basic cyber security tasks such as patching software, monitoring threat advisories and separating networks from one another. Increasingly serious cyber security problems are partly an inevitable consequence of the growing complexity of digital technology. But there are other causes too, including a lack of accountability that stems from the wide range of technology handlers: computer software vendors, antivirus suppliers, in-house professionals, consultants and various regulators. Ultimately, Corman said, hospitals need to hire solid cyber security people instead of another nurse or two. Good for business "What’s needed is punishment of the negligent," said Ross Anderson, a University of Cambridge pioneer in studying the economics of information security, referring to the hospitals that did not stop WannaCry. "This is not about technology. This is about people fouling up in ways people would get a pink slip for” in less-insulated environments, he said, meaning they would lose their jobs. For now, though, there are few signs of any revamp in large institutions' approach to cyber security - and little incentive for contractors in the cyber security industry to change. Sophos was not the only company whose stock rose on Monday, as the global scale of WannaCry became apparent. Shares of US-based FireEye and Qualys both rose more than 5 per cent. But Sophos stood out, aided by higher expectations for a product the company introduced last year to fend off ransomware - so called because the authors of the malware demand a 'ransom' to restore a user's infected computer - which worked at the hospitals that had installed it. "It's good news for our business," one Sophos employee, who asked not to be named, told Reuters this week. "We were so inundated with people calling us." (Reuters)

WannaCry ransomware attack good business for cyber security firms

Two-thirds of those caught up in the past week&#39;s global ransomware attack were running Microsoft&#39;s Windows 7 operating system without the latest security updates, a survey for Reuters by security ratings firm BitSight found.

Researchers are struggling to try to find early traces of WannaCry, which remains an active threat in hardest-hit China and Russia, believing that identifying &quot;patient zero&quot; could help catch its criminal authors.

They are having more luck dissecting flaws that limited its spread.

Security experts warn that while computers at more than 300,000 internet addresses were hit by the ransomware strain, further attacks that fix weaknesses in WannaCry will follow that hit larger numbers of users, with more devastating consequences.

&quot;Some organisations just aren&#39;t aware of the risks; some don&#39;t want to risk interrupting important business processes; sometimes they are short-staffed,&quot; said Ziv Mador, vice president of security research at Israel&#39;s SpiderLabs Trustwave.

&quot;There are plenty of reasons people wait to patch and none of them are good,&quot; said Mador, a former long-time security researcher for Microsoft.

WannaCry&#39;s worm-like capacity to infect other computers on the same network with no human intervention appear tailored to Windows 7, said Paul Pratley, head of investigations &amp; incident response at UK consulting firm MWR InfoSecurity.

Data from BitSight covering 160,000 internet-connected computers hit by WannaCry, shows that Windows 7 accounts for 67 per cent of infections, although it represents less than half of the global distribution of Windows PC users.

Computers running older versions, such as Windows XP used in Britain&#39;s NHS health system, while individually vulnerable to attack, appear incapable of spreading infections and played a far smaller role in the global attack than initially reported.

In laboratory testing, researchers at MWR and Kyptos say they have found Windows XP crashes before the virus can spread.

Windows 10, the latest version of Microsoft&#39;s flagship operating system franchise, accounts for another 15 per cent, while older versions of Windows including 8.1, 8, XP and Vista, account for the remainder, BitSight estimated.

Computer basics

Any organisation which heeded strongly worded warnings from Microsoft to urgently install a security patch it labelled &ldquo;critical&rdquo; when it was released on March 14 on all computers on their networks are immune, experts agree.

Those hit by WannaCry also failed to heed warnings last year from Microsoft to disable a file sharing feature in Windows known as SMB, which a covert hacker group calling itself Shadow Brokers had claimed was used by NSA intelligence operatives to sneak into Windows PCs.

&quot;Clearly people who run supported versions of Windows and patched quickly were not affected&quot;, Trustwave&#39;s Mador said.

Microsoft has faced criticism since 2014 for withdrawing support for older versions of Windows software such as 16-year-old Windows XP and requiring users to pay hefty annual fees instead. The British government cancelled a nationwide NHS support contract with Microsoft after a year, leaving upgrades to local trusts.

Seeking to head off further criticism in the wake of the WannaCry outbreak, the US&nbsp;software giant last weekend released a free patch for Windows XP and other older Windows versions that it previously only offered to paying customers.

Microsoft declined to comment for this story.

On Sunday, the US&nbsp;software giant called on intelligence services to strike a better balance between their desire to keep software flaws secret - in order to conduct espionage and cyber warfare - and sharing those flaws with technology companies to better secure the internet.

Half of all internet addresses corrupted globally by WannaCry are located in China and Russia, with 30 and 20 per cent respectively. Infection levels spiked again in both countries this week and remained high through Thursday, according to data supplied to Reuters by threat intelligence firm Kryptos Logic.

By contrast, the United States accounts for 7 per cent of WannaCry infections while Britain, France and Germany each represent just 2 per cent of worldwide attacks, Kryptos said.

Dumb and sophisticated

The ransomware mixes copycat software loaded with amateur coding mistakes and recently leaked spy tools widely believed to have been stolen from theS&nbsp;National Security Agency, creating a vastly potent class of crimeware.

&quot;What really makes the magnitude of this attack so much greater than any other is that the intent has changed from information stealing to business disruption&quot;, said Samil Neino, 32, chief executive of Los Angeles-based Kryptos Logic.

Last Friday, the company&#39;s British-based 22-year-old data breach research chief, Marcus Hutchins, created a &quot;kill-switch&quot;, which security experts have widely hailed as the decisive step in halting the ransomware&#39;s rapid spread around the globe.

WannaCry appears to target mainly enterprises rather than consumers: Once it infects one machine, it silently proliferates across internal networks which can connect hundreds or thousands of machines in large firms, unlike individual consumers at home.

An unknown number of computers sit behind the 300,000 infected internet connections identified by Kryptos.

Because of the way WannaCry spreads sneakily inside organisation networks, a far larger total of ransomed computers sitting behind company firewalls may be hit, possibly numbering upward of a million machines. The company is crunching data to arrive at a firmer estimate it aims to release later Thursday.

Liran Eshel, chief executive of cloud storage provider CTERA Networks, said: &quot;The attack shows how sophisticated ransomware has become, forcing even unaffected organisations to rethink strategies.&quot;

Escape route

Researchers from a variety of security firms say they have so far failed to find a way to decrypt files locked up by WannaCry and say chances are low anyone will succeed.

However, a bug in WannaCry code means the attackers cannot use unique bitcoin addresses to track payments, security researchers at Symantec found this week. The result: &quot;Users unlikely to get files restored&quot;, the company&#39;s Security Response team tweeted.

The rapid recovery by many organisations with unpatched computers caught out by the attack may largely be attributed to back-up and retrieval procedures they had in place, enabling technicians to re-image infected machines, experts said.

While encrypting individual computers it infects, WannaCry code does not attack network data-backup systems, as more sophisticated ransomware packages typically do, security experts who have studied WannaCry code agree.

These factors help explain the mystery of why such a tiny number of victims appear to have paid ransoms into the three bitcoin accounts to which WannaCry directs victims.

Less than 300 payments worth around $83,000 had been paid into WannaCry blackmail accounts by Thursday (1800 GMT), six days after the attack began and one day before the ransomware threatens to start locking up victim computers forever. (Reuters graphic: [http://tmsnrt.rs/2rqaLyz)

The Verizon 2017 Data Breach Investigations Report, the most comprehensive annual survey of security breakdowns, found that it takes three months before at least half of organisations install major new software security patches.

WannaCry landed nine weeks after Microsoft&#39;s patch arrived.

&quot;The same things are causing the same problems. That&#39;s what the data shows,&quot; MWR research head Pratley said.

&quot;We haven&#39;t seen many organisations fall over and that&#39;s because they did some of the security basics,&quot; he said.

(Reuters)

Researchers are struggling to try to find early traces of WannaCry, which remains an active threat in hardest-hit China and Russia

Two-thirds of those caught up in the past week's global ransomware attack were running Microsoft's Windows 7 operating system without the latest security updates, a survey for Reuters by security ratings firm BitSight found. Researchers are struggling to try to find early traces of WannaCry, which remains an active threat in hardest-hit China and Russia, believing that identifying "patient zero" could help catch its criminal authors. They are having more luck dissecting flaws that limited its spread. Security experts warn that while computers at more than 300,000 internet addresses were hit by the ransomware strain, further attacks that fix weaknesses in WannaCry will follow that hit larger numbers of users, with more devastating consequences. "Some organisations just aren't aware of the risks; some don't want to risk interrupting important business processes; sometimes they are short-staffed," said Ziv Mador, vice president of security research at Israel's SpiderLabs Trustwave. "There are plenty of reasons people wait to patch and none of them are good," said Mador, a former long-time security researcher for Microsoft. WannaCry's worm-like capacity to infect other computers on the same network with no human intervention appear tailored to Windows 7, said Paul Pratley, head of investigations & incident response at UK consulting firm MWR InfoSecurity. Data from BitSight covering 160,000 internet-connected computers hit by WannaCry, shows that Windows 7 accounts for 67 per cent of infections, although it represents less than half of the global distribution of Windows PC users. Computers running older versions, such as Windows XP used in Britain's NHS health system, while individually vulnerable to attack, appear incapable of spreading infections and played a far smaller role in the global attack than initially reported. In laboratory testing, researchers at MWR and Kyptos say they have found Windows XP crashes before the virus can spread. Windows 10, the latest version of Microsoft's flagship operating system franchise, accounts for another 15 per cent, while older versions of Windows including 8.1, 8, XP and Vista, account for the remainder, BitSight estimated. Computer basics Any organisation which heeded strongly worded warnings from Microsoft to urgently install a security patch it labelled “critical” when it was released on March 14 on all computers on their networks are immune, experts agree. Those hit by WannaCry also failed to heed warnings last year from Microsoft to disable a file sharing feature in Windows known as SMB, which a covert hacker group calling itself Shadow Brokers had claimed was used by NSA intelligence operatives to sneak into Windows PCs. "Clearly people who run supported versions of Windows and patched quickly were not affected", Trustwave's Mador said. Microsoft has faced criticism since 2014 for withdrawing support for older versions of Windows software such as 16-year-old Windows XP and requiring users to pay hefty annual fees instead. The British government cancelled a nationwide NHS support contract with Microsoft after a year, leaving upgrades to local trusts. Seeking to head off further criticism in the wake of the WannaCry outbreak, the US software giant last weekend released a free patch for Windows XP and other older Windows versions that it previously only offered to paying customers. Microsoft declined to comment for this story. On Sunday, the US software giant called on intelligence services to strike a better balance between their desire to keep software flaws secret - in order to conduct espionage and cyber warfare - and sharing those flaws with technology companies to better secure the internet. Half of all internet addresses corrupted globally by WannaCry are located in China and Russia, with 30 and 20 per cent respectively. Infection levels spiked again in both countries this week and remained high through Thursday, according to data supplied to Reuters by threat intelligence firm Kryptos Logic. By contrast, the United States accounts for 7 per cent of WannaCry infections while Britain, France and Germany each represent just 2 per cent of worldwide attacks, Kryptos said. Dumb and sophisticated The ransomware mixes copycat software loaded with amateur coding mistakes and recently leaked spy tools widely believed to have been stolen from theS National Security Agency, creating a vastly potent class of crimeware. "What really makes the magnitude of this attack so much greater than any other is that the intent has changed from information stealing to business disruption", said Samil Neino, 32, chief executive of Los Angeles-based Kryptos Logic. Last Friday, the company's British-based 22-year-old data breach research chief, Marcus Hutchins, created a "kill-switch", which security experts have widely hailed as the decisive step in halting the ransomware's rapid spread around the globe. WannaCry appears to target mainly enterprises rather than consumers: Once it infects one machine, it silently proliferates across internal networks which can connect hundreds or thousands of machines in large firms, unlike individual consumers at home. An unknown number of computers sit behind the 300,000 infected internet connections identified by Kryptos. Because of the way WannaCry spreads sneakily inside organisation networks, a far larger total of ransomed computers sitting behind company firewalls may be hit, possibly numbering upward of a million machines. The company is crunching data to arrive at a firmer estimate it aims to release later Thursday. Liran Eshel, chief executive of cloud storage provider CTERA Networks, said: "The attack shows how sophisticated ransomware has become, forcing even unaffected organisations to rethink strategies." Escape route Researchers from a variety of security firms say they have so far failed to find a way to decrypt files locked up by WannaCry and say chances are low anyone will succeed. However, a bug in WannaCry code means the attackers cannot use unique bitcoin addresses to track payments, security researchers at Symantec found this week. The result: "Users unlikely to get files restored", the company's Security Response team tweeted. The rapid recovery by many organisations with unpatched computers caught out by the attack may largely be attributed to back-up and retrieval procedures they had in place, enabling technicians to re-image infected machines, experts said. While encrypting individual computers it infects, WannaCry code does not attack network data-backup systems, as more sophisticated ransomware packages typically do, security experts who have studied WannaCry code agree. These factors help explain the mystery of why such a tiny number of victims appear to have paid ransoms into the three bitcoin accounts to which WannaCry directs victims. Less than 300 payments worth around $83,000 had been paid into WannaCry blackmail accounts by Thursday (1800 GMT), six days after the attack began and one day before the ransomware threatens to start locking up victim computers forever. (Reuters graphic: [http://tmsnrt.rs/2rqaLyz) The Verizon 2017 Data Breach Investigations Report, the most comprehensive annual survey of security breakdowns, found that it takes three months before at least half of organisations install major new software security patches. WannaCry landed nine weeks after Microsoft's patch arrived. "The same things are causing the same problems. That's what the data shows," MWR research head Pratley said. "We haven't seen many organisations fall over and that's because they did some of the security basics," he said. (Reuters)

Security experts find clues to ransomware worm's lingering risks

Governments turned their attention to a possible new wave of cyber threats after the group that leaked US&nbsp;hacking tools used to launch the global WannaCry &quot;ransomware&quot; attack warned it would release more malicious code.

The fast-spreading cyber extortion campaign, which has infected more than 3,00,000 computers worldwide since Friday, eased for second day on Tuesday, but the identity and motive of its creators remain unknown.

The attack includes elements that belong to the US&nbsp;National Security Agency and were leaked online last month.

Shadow Brokers, the group that has taken credit for that leak, threatened on Tuesday to release more recent code to enable hackers to break into the world&#39;s most widely used computers, software and phones.

A blog post written by the group promised from June to release tools every month to anyone willing to pay for access to some of the tech world&#39;s biggest commercial secrets.

It also threatened to dump data from banks using the SWIFT international money transfer network and from Russian, Chinese, Iranian or North Korean nuclear and missile programs. &quot;More details in June,&quot; it promised.

The spread of the WannaCry attack - which encrypts a user&#39;s data and demands a &quot;ransom&quot; be paid electronically to free it up again - slowed to a trickle on Tuesday, with few, isolated examples being reported.

In Canada, the Universite de Montreal was hit, with 120 of the French-language university&rsquo;s 8,300 computers affected, according to a university spokeswoman.

There were no new, major incidents in the United States. Fewer than 10 US&nbsp;organisations have reported attacks to the Department of Homeland Security since Friday, a US&nbsp;official told reporters on Tuesday.

The attack has caused most damage in Russia, Taiwan, Ukraine and India, according to Czech security firm Avast.

The United States likely avoided greater harm as the attack targeted older versions of Microsoft&#39;s Windows operating system, and more US&nbsp;users have licensed, up-to-date, patched versions of the software, compared to other regions of the world.

The Department of Homeland Security began an &quot;aggressive awareness campaign&quot; to alert the tech industry to the importance of installing the patch that Microsoft issued in March that protected users from the vulnerability exploited by the attack, a US&nbsp;official working on the attack told Reuters.

Microsoft said on Tuesday it was aware of Shadow Brokers&#39; most recent claim and that its security teams monitor potential threats in order to &quot;help us prioritise and take appropriate action.&quot;

Microsoft President and Chief Legal Officer Brad Smith said earlier this week the WannaCry attack used elements stolen from the NSA. The US&nbsp;government has not commented directly on the matter.

North Korea link probed

Cyber security researchers around the world have said they have found evidence that could link North Korea with the WannaCry cyber attack.

A researcher from South Korea&#39;s Hauri Labs said on Tuesday their own findings matched those of Symantecand Kaspersky, who said on Monday that some code in an earlier version of the WannaCry software had also appeared in programs used by the Lazarus Group, identified by some researchers as a North Korea-run hacking operation.

&quot;It is similar to North Korea&#39;s backdoor malicious codes,&quot; said Simon Choi, a senior researcher with Hauri who has done extensive research into North Korea&#39;s hacking capabilities and advises South Korean police and National Intelligence Service.

Both Symantec and Kaspersky said it was too early to tell whether North Korea was involved in the attacks, based on the evidence that was published on Twitter by Google security researcher Neel Mehta.

FireEye, another large cyber security firm, said it was also investigating, but it was cautious about drawing a link to North Korea.

&quot;The similarities we see between malware linked to that group and WannaCry are not unique enough to be strongly suggestive of a common operator,&quot; FireEye researcher John Miller said.

US&nbsp;and European security officials told Reuters on condition of anonymity that it was too early to say who might be behind the attacks, but they did not rule out North Korea as a suspect.

The Lazarus hackers, acting for impoverished North Korea, have been more brazen in their pursuit of financial gain than others, and have been blamed for the theft of $81 million from the Bangladesh central bank, according to some cyber security firms. The United States accused it of being behind a cyber attack on Sony Pictures in 2014.

North Korea has denied being behind the Sony and banking attacks. North Korean officials were not immediately available for comment and its state media has been quiet about the matter.

No information to share

In China, foreign ministry spokeswoman Hua Chunying said she had no information to share, when asked about the origin of the attack and whether North Korea might be connected.

Several Asian countries have been affected by the malware, although the impact has not been as widespread as some had feared.

In Malaysia, cyber security firm LE Global Services said it identified 12 cases so far, including a large government-linked corporation, a government-linked investment firm and an insurance company. It did not name any of the entities.

&quot;We may not see the real picture yet, as companies are not mandated to disclose security breaches to authorities in Malaysia,&quot; said LE Global CEO Fong Choong Fook.

&quot;The real situation may be serious. In one of the cases, the attack was traced back to early April.&quot;

Vietnam&#39;s state media said on Tuesday more than 200 computers had been affected, but one of the country&#39;s leading anti virus companies, Bkav, later put the figure at 1,900.

Taiwan Power said that nearly 800 of its computers were affected, although these were used for administration, not for systems involved in electricity generation.

(Reuters)

The fast-spreading cyber extortion campaign has infected more than 300,000 computers worldwide

Governments turned their attention to a possible new wave of cyber threats after the group that leaked US hacking tools used to launch the global WannaCry "ransomware" attack warned it would release more malicious code. The fast-spreading cyber extortion campaign, which has infected more than 3,00,000 computers worldwide since Friday, eased for second day on Tuesday, but the identity and motive of its creators remain unknown. The attack includes elements that belong to the US National Security Agency and were leaked online last month. Shadow Brokers, the group that has taken credit for that leak, threatened on Tuesday to release more recent code to enable hackers to break into the world's most widely used computers, software and phones. A blog post written by the group promised from June to release tools every month to anyone willing to pay for access to some of the tech world's biggest commercial secrets. It also threatened to dump data from banks using the SWIFT international money transfer network and from Russian, Chinese, Iranian or North Korean nuclear and missile programs. "More details in June," it promised. The spread of the WannaCry attack - which encrypts a user's data and demands a "ransom" be paid electronically to free it up again - slowed to a trickle on Tuesday, with few, isolated examples being reported. In Canada, the Universite de Montreal was hit, with 120 of the French-language university’s 8,300 computers affected, according to a university spokeswoman. There were no new, major incidents in the United States. Fewer than 10 US organisations have reported attacks to the Department of Homeland Security since Friday, a US official told reporters on Tuesday. The attack has caused most damage in Russia, Taiwan, Ukraine and India, according to Czech security firm Avast. The United States likely avoided greater harm as the attack targeted older versions of Microsoft's Windows operating system, and more US users have licensed, up-to-date, patched versions of the software, compared to other regions of the world. The Department of Homeland Security began an "aggressive awareness campaign" to alert the tech industry to the importance of installing the patch that Microsoft issued in March that protected users from the vulnerability exploited by the attack, a US official working on the attack told Reuters. Microsoft said on Tuesday it was aware of Shadow Brokers' most recent claim and that its security teams monitor potential threats in order to "help us prioritise and take appropriate action." Microsoft President and Chief Legal Officer Brad Smith said earlier this week the WannaCry attack used elements stolen from the NSA. The US government has not commented directly on the matter. North Korea link probed Cyber security researchers around the world have said they have found evidence that could link North Korea with the WannaCry cyber attack. A researcher from South Korea's Hauri Labs said on Tuesday their own findings matched those of Symantecand Kaspersky, who said on Monday that some code in an earlier version of the WannaCry software had also appeared in programs used by the Lazarus Group, identified by some researchers as a North Korea-run hacking operation. "It is similar to North Korea's backdoor malicious codes," said Simon Choi, a senior researcher with Hauri who has done extensive research into North Korea's hacking capabilities and advises South Korean police and National Intelligence Service. Both Symantec and Kaspersky said it was too early to tell whether North Korea was involved in the attacks, based on the evidence that was published on Twitter by Google security researcher Neel Mehta. FireEye, another large cyber security firm, said it was also investigating, but it was cautious about drawing a link to North Korea. "The similarities we see between malware linked to that group and WannaCry are not unique enough to be strongly suggestive of a common operator," FireEye researcher John Miller said. US and European security officials told Reuters on condition of anonymity that it was too early to say who might be behind the attacks, but they did not rule out North Korea as a suspect. The Lazarus hackers, acting for impoverished North Korea, have been more brazen in their pursuit of financial gain than others, and have been blamed for the theft of $81 million from the Bangladesh central bank, according to some cyber security firms. The United States accused it of being behind a cyber attack on Sony Pictures in 2014. North Korea has denied being behind the Sony and banking attacks. North Korean officials were not immediately available for comment and its state media has been quiet about the matter. No information to share In China, foreign ministry spokeswoman Hua Chunying said she had no information to share, when asked about the origin of the attack and whether North Korea might be connected. Several Asian countries have been affected by the malware, although the impact has not been as widespread as some had feared. In Malaysia, cyber security firm LE Global Services said it identified 12 cases so far, including a large government-linked corporation, a government-linked investment firm and an insurance company. It did not name any of the entities. "We may not see the real picture yet, as companies are not mandated to disclose security breaches to authorities in Malaysia," said LE Global CEO Fong Choong Fook. "The real situation may be serious. In one of the cases, the attack was traced back to early April." Vietnam's state media said on Tuesday more than 200 computers had been affected, but one of the country's leading anti virus companies, Bkav, later put the figure at 1,900. Taiwan Power said that nearly 800 of its computers were affected, although these were used for administration, not for systems involved in electricity generation. (Reuters)

WannaCry: Cyber attack eases, but hacking group threatens to sell code

Major cyber security firms Symantec&nbsp;and Kaspersky said on Monday they were looking into clues that may connect the global &quot;ransomware&quot; attack known as WannaCry with programs previously attributed to North Korea.

The two companies said some code in an earlier version of the WannaCry ransomware, which has encrypted data on hundreds of thousands of computers since Friday, had also appeared in programs used by the Lazarus Group, which researchers from many companies said is run by North Korea.&nbsp;

The ransomware demanded users pay money to regain control of their machines,

The North Korean mission to the United Nations was not immediately available for comment.

(Reuters)

The ransomware which has encrypted data on hundreds of thousands of computers demands users pay money to regain control of their machines

Major cyber security firms Symantec and Kaspersky said on Monday they were looking into clues that may connect the global "ransomware" attack known as WannaCry with programs previously attributed to North Korea. The two companies said some code in an earlier version of the WannaCry ransomware, which has encrypted data on hundreds of thousands of computers since Friday, had also appeared in programs used by the Lazarus Group, which researchers from many companies said is run by North Korea. The ransomware demanded users pay money to regain control of their machines, The North Korean mission to the United Nations was not immediately available for comment. (Reuters)

Possible North Korea tie to the WannaCry ransomware attack

ransomware-attack

Ransomware Attack, News on Ransomware Attack, stories on Ransomware Attack, articles on Ransomware Attack, Ransomware Attack stories at Wion, Ransomware Attack news, Ransomware Attack latest news