United States government on Thursday lauched an online hub to help victims of ransomware attacks to find resources and assistance. The initiative is led by Justice and Homeland Security Department of the US government.

The webisite WWW.StopRansomware.gov apparently aims for being an under-one-roof resource for victims of ransomware.

Many of the resources and information that organizations need to deal with ransomware attacks have historically been scattered across multiple websites, which increased the "likelihood of missing important information," the Justice Department said in a statement.

The new website is "the first central hub consolidating ransomware resources from all federal government agencies," it said.

The launch comes shortly after ransomware attack on Colonial Pipeline that caused shortages at gas stations US East Coast.

The Justice Department was later able to help Colonial Pipeline recover some $2.3 million in cryptocurrency ransom it paid to hackers.

About $350 million in ransom was paid to cyber criminals in 2020, a more than 300% increase from the previous year, the department said.

“The Department of Justice is committed to protecting Americans from the rise in ransomware attacks that we have seen in recent years," Attorney General Merrick Garland said.

(With inputs from agencies)

United States government on Thursday lauched an online hub to help victims of ransomware attacks to find resources and assistance. The initiative is led by Justice and Homeland Security Department of the US government.

United States government on Thursday lauched an online hub to help victims of ransomware attacks to find resources and assistance. The initiative is led by Justice and Homeland Security Department of the US government. The webisite WWW.StopRansomware.gov apparently aims for being an under-one-roof resource for victims of ransomware. Many of the resources and information that organizations need to deal with ransomware attacks have historically been scattered across multiple websites, which increased the "likelihood of missing important information," the Justice Department said in a statement. The new website is "the first central hub consolidating ransomware resources from all federal government agencies," it said. The launch comes shortly after ransomware attack on Colonial Pipeline that caused shortages at gas stations US East Coast. The Justice Department was later able to help Colonial Pipeline recover some $2.3 million in cryptocurrency ransom it paid to hackers. About $350 million in ransom was paid to cyber criminals in 2020, a more than 300% increase from the previous year, the department said. “The Department of Justice is committed to protecting Americans from the rise in ransomware attacks that we have seen in recent years," Attorney General Merrick Garland said. (With inputs from agencies)

US govt launches website to help ransomware victims

US President Joe Biden has warned Russia of consequences for the ransomware attacks emanating from the country, underscoring the need for Moscow to take action against groups engaged in the crime.

Biden spoke with Russian President Vladimir Putin on Friday about the ongoing ransomware attacks by criminals based in Russia that have impacted the US and other countries around the world, the White House said in a readout of the call.

“Yes,” Biden told reporters at the White House hours after his call with Putin on this issue when asked if there would be consequences to the ransomware attack. 
 
<a href="https://www.wionews.com/technology/hackers-linked-to-russia-reportedly-demand-70-million-from-companies-hit-by-cyberattack-395947">Also read | Hackers linked to Russia reportedly demand $70 million from companies hit by cyberattack</a>

“I made it very clear to him that the United States expects, when a ransomware operation is coming from his soil, even though it’s not sponsored by the state, we expect them to act if we give them enough information to act on who that is,” he said.

“And, secondly, that we have set up a means of communications now, on a regular basis, to be able to communicate to one another when each of us thinks something is happening in another country that affects the home country,” Biden said.

During the call, the White House said, Biden underscored the need for Russia to take action to disrupt ransomware groups operating in Russia and emphasised that he is committed to continued engagement on the broader threat posed by ransomware.

During the call, Biden reiterated that the United States will take any necessary action to defend its people and its critical infrastructure in the face of this continuing challenge.

“The President has also called on governments and agencies to modernise their defences to meet this threat, building on the President’s executive order on cybersecurity that was released in May,” a senior administration official told reporters.

“I want to say a few other things about this: The President really meant what he said just after concluding the summit meeting in Geneva, when he said that our assessment of this process and our evaluation of Russia’s actions would take time and play out over time. The President said six months or more,” the official said.

“This is more than just a conversation that’s taking place between the two leaders, President Biden and President Putin. This is really about our own resilience, as a nation, in the face of these attacks, and strengthening that. That’s what the cybersecurity executive order was largely about,” said the senior administration official.

US President Joe Biden has warned Russia of consequences for the ransomware attacks emanating from the country, underscoring the need for Moscow to take action against groups engaged in the crime.

US President Joe Biden has warned Russia of consequences for the ransomware attacks emanating from the country, underscoring the need for Moscow to take action against groups engaged in the crime. Biden spoke with Russian President Vladimir Putin on Friday about the ongoing ransomware attacks by criminals based in Russia that have impacted the US and other countries around the world, the White House said in a readout of the call. “Yes,” Biden told reporters at the White House hours after his call with Putin on this issue when asked if there would be consequences to the ransomware attack. Also read | Hackers linked to Russia reportedly demand $70 million from companies hit by cyberattack “I made it very clear to him that the United States expects, when a ransomware operation is coming from his soil, even though it’s not sponsored by the state, we expect them to act if we give them enough information to act on who that is,” he said. “And, secondly, that we have set up a means of communications now, on a regular basis, to be able to communicate to one another when each of us thinks something is happening in another country that affects the home country,” Biden said. During the call, the White House said, Biden underscored the need for Russia to take action to disrupt ransomware groups operating in Russia and emphasised that he is committed to continued engagement on the broader threat posed by ransomware. During the call, Biden reiterated that the United States will take any necessary action to defend its people and its critical infrastructure in the face of this continuing challenge. “The President has also called on governments and agencies to modernise their defences to meet this threat, building on the President’s executive order on cybersecurity that was released in May,” a senior administration official told reporters. “I want to say a few other things about this: The President really meant what he said just after concluding the summit meeting in Geneva, when he said that our assessment of this process and our evaluation of Russia’s actions would take time and play out over time. The President said six months or more,” the official said. “This is more than just a conversation that’s taking place between the two leaders, President Biden and President Putin. This is really about our own resilience, as a nation, in the face of these attacks, and strengthening that. That’s what the cybersecurity executive order was largely about,” said the senior administration official.

Joe Biden warns Vladimir Putin on ransomware attack from Russia

President Joe Biden said on Tuesday the ransomware attack centered on the Florida information technology firm Kaseya seems to have inflicted only 'minimal damage' on American businesses. 
 
"It appears to have caused minimal damage to US&nbsp;businesses, but we're still gathering information," Biden told reporters following a briefing from advisers. 
 
"I feel good about our ability to be able to respond." 
 
Friday's ransomware attack scrambled the data of hundreds of small businesses worldwide, including many in the United States. REvil, a prolific, Russia-linked cybercrime syndicate, took credit for the breach. 
 
The president's comments follow a statement from Kaseya that the attack never posed a threat to critical US&nbsp;infrastructure, which Biden declared off-limits during a summit with Russian President Vladimir Putin last month. 
 
But the attack was another illustration of how cybercriminals believed to be operating from Russia are running amok in the United States. Biden has sought to push Putin to bring Russian cybercriminals to heel, so far to little visible effect. 
 
Attacks have escalated recently. 
 
Last month REvil extorted an $11 million ransom out of meatpacker JBS after snarling its supply chain. In May, an intrusion by another Russia-linked group at major US&nbsp;fuel transporter Colonial Pipeline led to panic buying, price spikes, and gasoline shortages up and down the East Coast. 
 
The Republican National Committee said on Tuesday, it learned over the weekend that third-party provider Synnex Corp had been breached, but an investigation by Microsoft Corp determined that no RNC data had been accessed. 
 
White House spokeswoman Jen Psaki said earlier on Tuesday that senior US&nbsp;officials would meet their Russian counterparts next week to discuss the ransomware menace. 
 
"If the Russian government cannot or will not take action against criminal actors residing in Russia, we will take action, or reserve the right to take action, on our own," she said. 
 
The Russian Embassy in Washington and the US&nbsp;National Security Council did not return messages seeking further details about the meeting. 
 
On Wednesday, Biden will meet with officials from the Justice Department, State Department, the Department of Homeland Security and the intelligence community to discuss ransomware and US&nbsp;efforts to counter it, Psaki said. 
 
The hack that struck Kaseya's clients, many of whom are back office IT shops commonly referred to as managed service providers, did not have the same kind of impact in the United States as the ransoming of Colonial Pipeline. 
 
Disruption elsewhere was more severe. 
 
In Sweden, many of the 800 grocery stores run by the Coop chain are still in the process of recovering from the attack, which knocked out most of its supermarkets, though a spokesman said, "we have more open stores than closed ones now." 
 
In New Zealand, 11 schools and several kindergartens were affected. 
 
Germany's cybersecurity watchdog, BSI, said on Tuesday that it was aware of three IT service providers in Germany that were affected, with a spokesperson estimating that several hundred companies were touched overall. 
 
"In Germany, there are no cases as prominent as the one in Sweden," the spokesperson added. 
 
The hackers, who claimed responsibility for the breach, have demanded $70 million to restore all the affected businesses' data, although they have indicated a willingness to temper their demands in private conversations with a cybersecurity expert. 
 
Kaseya's CEO said he would not reveal whether his company planned to pay the ransom or not, or even whether it was negotiating with REvil. 
 
Psaki said that while the administration discouraged such payments, questions about whether the data would be ransomed should be directed to Kaseya. 
 
(With inputs from agencies)

President Joe Biden said on Tuesday the ransomware attack centered on the Florida information technology firm Kaseya seems to have inflicted only 'minimal damage' on American businesses.

President Joe Biden said on Tuesday the ransomware attack centered on the Florida information technology firm Kaseya seems to have inflicted only 'minimal damage' on American businesses. "It appears to have caused minimal damage to US businesses, but we're still gathering information," Biden told reporters following a briefing from advisers. "I feel good about our ability to be able to respond." Friday's ransomware attack scrambled the data of hundreds of small businesses worldwide, including many in the United States. REvil, a prolific, Russia-linked cybercrime syndicate, took credit for the breach. The president's comments follow a statement from Kaseya that the attack never posed a threat to critical US infrastructure, which Biden declared off-limits during a summit with Russian President Vladimir Putin last month. But the attack was another illustration of how cybercriminals believed to be operating from Russia are running amok in the United States. Biden has sought to push Putin to bring Russian cybercriminals to heel, so far to little visible effect. Attacks have escalated recently. Last month REvil extorted an $11 million ransom out of meatpacker JBS after snarling its supply chain. In May, an intrusion by another Russia-linked group at major US fuel transporter Colonial Pipeline led to panic buying, price spikes, and gasoline shortages up and down the East Coast. The Republican National Committee said on Tuesday, it learned over the weekend that third-party provider Synnex Corp had been breached, but an investigation by Microsoft Corp determined that no RNC data had been accessed. White House spokeswoman Jen Psaki said earlier on Tuesday that senior US officials would meet their Russian counterparts next week to discuss the ransomware menace. "If the Russian government cannot or will not take action against criminal actors residing in Russia, we will take action, or reserve the right to take action, on our own," she said. The Russian Embassy in Washington and the US National Security Council did not return messages seeking further details about the meeting. On Wednesday, Biden will meet with officials from the Justice Department, State Department, the Department of Homeland Security and the intelligence community to discuss ransomware and US efforts to counter it, Psaki said. The hack that struck Kaseya's clients, many of whom are back office IT shops commonly referred to as managed service providers, did not have the same kind of impact in the United States as the ransoming of Colonial Pipeline. Disruption elsewhere was more severe. In Sweden, many of the 800 grocery stores run by the Coop chain are still in the process of recovering from the attack, which knocked out most of its supermarkets, though a spokesman said, "we have more open stores than closed ones now." In New Zealand, 11 schools and several kindergartens were affected. Germany's cybersecurity watchdog, BSI, said on Tuesday that it was aware of three IT service providers in Germany that were affected, with a spokesperson estimating that several hundred companies were touched overall. "In Germany, there are no cases as prominent as the one in Sweden," the spokesperson added. The hackers, who claimed responsibility for the breach, have demanded $70 million to restore all the affected businesses' data, although they have indicated a willingness to temper their demands in private conversations with a cybersecurity expert. Kaseya's CEO said he would not reveal whether his company planned to pay the ransom or not, or even whether it was negotiating with REvil. Psaki said that while the administration discouraged such payments, questions about whether the data would be ransomed should be directed to Kaseya. (With inputs from agencies)

Biden says ransomware attack caused 'minimal damage' to US companies

Computer systems of several companies across the world that were shut down after attacked by REvil ransomware could take weeks to recover, cybersecurity experts said.

World Business Watch: REvil ransomware-hit firms could take weeks to recover, says experts

JBS, the largest meat supplier in the world has confirmed that it paid the equivalent of $11 million in ransom to hackers following a cyberattack that disrupted its North American and Australian operations.

Meat supplier JBS paid $11 million to ransomware attackers

US President Joe Biden said on Monday that there was no evidence of Russian government involvement in a cyberattack that crippled functioning of Colonial pipeline. The company manages huge network of fuel supply within the US.

However, Biden said that there were indications that the ransomware was "in Russia".&nbsp;

"So far there is no evidence based on, from our intelligence people, that Russia is involved," Biden said in the White House.&nbsp;

"Although there is evidence that the actors, ransomware is in Russia. They have some responsibility to deal with this."

Colonial Pipeline is slowly restoring the fuel supply. On Monday, it said that operations were being "brought back online in a stepwise fashion" after Saturday's complete shutdown due to a cyberattack.

The affected pipeline ships gasoline and jet fuel from the Gulf Coast of Texas to the populous East Coast through 5,500 miles (8,850 kilometers) of conduit, serving 50 million consumers.

Just a few days ago Colonial Pipeline operations were crippled due to a cyberattack. It was a ransomware attack. Such an attack encrypts computer systems and seeks to extract payment.

The Federal Bureau of Investigation (FBI) identified DarkSide as the group which produced the ransomware used in the attack.

(With inputs from agencies)

US President Joe Biden said on Monday that there was no evidence of Russian government involvement in a cyberattack that crippled functioning of Colonial pipeline.

US President Joe Biden said on Monday that there was no evidence of Russian government involvement in a cyberattack that crippled functioning of Colonial pipeline. The company manages huge network of fuel supply within the US. However, Biden said that there were indications that the ransomware was "in Russia". "So far there is no evidence based on, from our intelligence people, that Russia is involved," Biden said in the White House. "Although there is evidence that the actors, ransomware is in Russia. They have some responsibility to deal with this." Colonial Pipeline is slowly restoring the fuel supply. On Monday, it said that operations were being "brought back online in a stepwise fashion" after Saturday's complete shutdown due to a cyberattack. The affected pipeline ships gasoline and jet fuel from the Gulf Coast of Texas to the populous East Coast through 5,500 miles (8,850 kilometers) of conduit, serving 50 million consumers. Just a few days ago Colonial Pipeline operations were crippled due to a cyberattack. It was a ransomware attack. Such an attack encrypts computer systems and seeks to extract payment. The Federal Bureau of Investigation (FBI) identified DarkSide as the group which produced the ransomware used in the attack. (With inputs from agencies)

No evidence of Russian government being behind ransomware attack, says Biden

Cyberattack-hit top US pipeline network Colonial Pipeline said on Monday that it had begun phased restart of a giant US gasoline pipeline. The company said it hoped to restore operations by the end of the week.

The pipeline company said operations were being "brought back online in a stepwise fashion" after Saturday's complete shutdown due to a cyberattack.&nbsp;

While "the situation remains fluid and continues to evolve," the company said it has a goal of "substantially restoring operational service by the end of the week."

The affected pipeline ships gasoline and jet fuel from the Gulf Coast of Texas to the populous East Coast through 5,500 miles (8,850 kilometers) of conduit, serving 50 million consumers.

Just a few days ago Colonial Pipeline operations were crippled due to a cyberattack. It was a ransomware attack. Such an attack encrypts computer systems and seeks to extract payment.

The Federal Bureau of Investigation (FBI) identified DarkSide as the group which produced the ransomware used in the attack.

DarkSide is an enigmatic group that surfaced last year with its corporate-style approach to inserting itself into a target's computers, locking them up and demanding payment in exchange for supplying the tools to digitally unfreeze them.

The shutdown raised fears gasoline prices could shoot up ahead of the Memorial Day holiday May 31, but oil and gasoline prices were little changed near 1710 GMT.

(With inputs from agencies)

Cyberattack-hit top US pipeline network Colonial Pipeline said on Monday that it had begun phased restart of a giant US gasoline pipeline. The company said it hoped to restore operations by the end of the week.

Cyberattack-hit top US pipeline network Colonial Pipeline said on Monday that it had begun phased restart of a giant US gasoline pipeline. The company said it hoped to restore operations by the end of the week. The pipeline company said operations were being "brought back online in a stepwise fashion" after Saturday's complete shutdown due to a cyberattack. While "the situation remains fluid and continues to evolve," the company said it has a goal of "substantially restoring operational service by the end of the week." The affected pipeline ships gasoline and jet fuel from the Gulf Coast of Texas to the populous East Coast through 5,500 miles (8,850 kilometers) of conduit, serving 50 million consumers. Just a few days ago Colonial Pipeline operations were crippled due to a cyberattack. It was a ransomware attack. Such an attack encrypts computer systems and seeks to extract payment. The Federal Bureau of Investigation (FBI) identified DarkSide as the group which produced the ransomware used in the attack. DarkSide is an enigmatic group that surfaced last year with its corporate-style approach to inserting itself into a target's computers, locking them up and demanding payment in exchange for supplying the tools to digitally unfreeze them. The shutdown raised fears gasoline prices could shoot up ahead of the Memorial Day holiday May 31, but oil and gasoline prices were little changed near 1710 GMT. (With inputs from agencies)

Colonial pipeline to restore Gasoline flow this week

Apple may be the influential tech company that is at the forefront of innovation but when it comes top sophisticated cyberattack, Apple's interests are as vulnerable as our tech-challenged friend's computer.

The company is now facing a 'ransomware attack'. For those who don't know what this is, a ransomware attack involves cybercriminals encrypting your valuable data. After the data becomes inaccessible to you, the hackers ask ransom money to provide the key to break the encryption.

Apple has been on the receiving end because of&nbsp;an attack on one of its suppliers.

The group of hackers calls themselves 'Sodin' and the ransomware is called 'REvil'. The hackers stole Apple's data from Quanta Computer, a Taiwanese company that assembles some of Apple's laptops.

The hackers claim that the stolen information has to do with Apple's upcoming products. These, they say, include Apple laptops and a new Apple Watch

Quanta Computer has refused to pay the ransom and hackers are now threatening that they will make information about Apple's next launches public.

Well, well. What will Apple do next? They aren't saying anything for now that's for sure!

Apple may be the influential tech company that is at the forefront of innovation but when it comes top sophisticated cyberattack, Apple's interests are as vulnerable as our tech-challenged friend's computer.

Apple may be the influential tech company that is at the forefront of innovation but when it comes top sophisticated cyberattack, Apple's interests are as vulnerable as our tech-challenged friend's computer. The company is now facing a 'ransomware attack'. For those who don't know what this is, a ransomware attack involves cybercriminals encrypting your valuable data. After the data becomes inaccessible to you, the hackers ask ransom money to provide the key to break the encryption. Apple has been on the receiving end because of an attack on one of its suppliers. The group of hackers calls themselves 'Sodin' and the ransomware is called 'REvil'. The hackers stole Apple's data from Quanta Computer, a Taiwanese company that assembles some of Apple's laptops. The hackers claim that the stolen information has to do with Apple's upcoming products. These, they say, include Apple laptops and a new Apple Watch Quanta Computer has refused to pay the ransom and hackers are now threatening that they will make information about Apple's next launches public. Well, well. What will Apple do next? They aren't saying anything for now that's for sure!

Apple faces ransomware demand from cybercriminals

19 security firms, tech companies, and non-profit organisation have come together to create the “Ransomware Task Force” (RTF). Companies including Microsoft and McAfee have come&nbsp;together to fight ransomware.&nbsp;

Also read:&nbsp;<a href="https://www.wionews.com/technology/privacy-apps-you-needed-to-have-downloaded-in-2020-352014" hreflang="en">Privacy apps you needed to have downloaded in 2020</a>

The RTF will assess technical solutions that are already in place, along with providing protections during an attack.

Besides monitoring the state of mechanisms in place, the RTF will commission research on the topic, engage with key players across industries, and find&nbsp;problems in the existing mechanism, while finding solutions to these problems.

Also read:&nbsp;<a href="https://www.wionews.com/technology/godaddy-apologises-to-employees-after-christmas-bonus-email-turned-out-to-be-security-test-352312" hreflang="en">GoDaddy apologises to employees after Christmas bonus email turned out to be security test</a>

In addition, the RTF will also navigate across all potential solutions to carve out a roadmap to address serious issues.&nbsp;

The goal is to come up with a standardised framework to deal with ransomware attacks across industries. To achieve this, the RTF intends to consult industry players, instead of individual advice usually given out by contractors.

And 19 founding members of the RTF include big shots like Microsoft, McAfee along with many groups include Team Cymru, Aspen Digital, Citrix, The Cyber Threat Alliance, Cybereason, The Cybersecurity Coalition among many.

Also read:&nbsp;<a href="https://www.wionews.com/technology/dozens-sue-amazons-ring-smart-cameras-over-horrific-invasions-of-privacy-352053" hreflang="en">Dozens sue Amazon's Ring smart cameras over 'horrific' invasions of privacy</a>

Ransomware is a type of malware which threatens to publish the data of its victim unless a ransom is paid. In addition, access to that data may be perpetually blocked until the ransom is paid.

Ransomware is not the most common form of malware, but still remains a major threat, with the threat of ransoms growing from quarter to quarter.

Even then, the Federal Bureau of Investigation has revealed that BEC scams continue to cause the largest financial losses to companies every year.

19 security firms, tech companies, and non-profit organisation have come together to create the “Ransomware Task Force” (RTF). Companies including Microsoft and McAfee have come together to fight ransomware.

19 security firms, tech companies, and non-profit organisation have come together to create the “Ransomware Task Force” (RTF). Companies including Microsoft and McAfee have come together to fight ransomware. Also read: Privacy apps you needed to have downloaded in 2020 The RTF will assess technical solutions that are already in place, along with providing protections during an attack. Besides monitoring the state of mechanisms in place, the RTF will commission research on the topic, engage with key players across industries, and find problems in the existing mechanism, while finding solutions to these problems. Also read: GoDaddy apologises to employees after Christmas bonus email turned out to be security test In addition, the RTF will also navigate across all potential solutions to carve out a roadmap to address serious issues. The goal is to come up with a standardised framework to deal with ransomware attacks across industries. To achieve this, the RTF intends to consult industry players, instead of individual advice usually given out by contractors. And 19 founding members of the RTF include big shots like Microsoft, McAfee along with many groups include Team Cymru, Aspen Digital, Citrix, The Cyber Threat Alliance, Cybereason, The Cybersecurity Coalition among many. Also read: Dozens sue Amazon's Ring smart cameras over 'horrific' invasions of privacy Ransomware is a type of malware which threatens to publish the data of its victim unless a ransom is paid. In addition, access to that data may be perpetually blocked until the ransom is paid. Ransomware is not the most common form of malware, but still remains a major threat, with the threat of ransoms growing from quarter to quarter. Even then, the Federal Bureau of Investigation has revealed that BEC scams continue to cause the largest financial losses to companies every year.

Tech companies, firms like Microsoft and McAfee institute the 'Ransomware Task Force'

The official website of an A-list law firm, which has several celebrity clients like Lady Gaga, Robert DeNiro, Elton John and others, has been hacked. 
 
The website for Grubman Shire Meiselas &amp; Sacks is down and hackers have claimed to have access to 756 gigabytes of data including contracts and personal emails. 
 
A screenshot allegedly of a contract of popstar Madonna has been released and the hackers are now demanding payment. 
 
The New York-based firm states it has notified its clients and is working with cyber-security experts. It is not known yet how much the hackers are demanding or if the law firm is negotiating with them. 
 
In a statement released to the press, the firm states, “We can confirm that we've been victimized by a cyber-attack. We have notified our clients and our staff. We have hired the world's experts who specialise in this area, and we are working around the clock to address these matters." 
 
The company's website is displaying just a logo but historic records of the site show a client list of more than 200 high profile people and companies. 
 
Some of the world’s most prominent celebrities are handled by the law firm which includes musicians Sir Elton John, Barbra Streisand, Barry Manilow, Rod Stewart, Lady Gaga, Lil Nas X, The Weeknd, Madonna, U2 and Drake. Priyanka Chopra, Robert De Niro, Sofia Vergara, and Mike Tyson are also part of the film’s clientele. 
 
he hackers have been identified as REvil or Sodinokibi who previously attacked foreign exchange company Travelex in January. That case was too, was ransomware. 
 
Ransomware is typically a malicious type of software that encrypts data until a ransom is paid, usually in untraceable crypto-currency Bitcoin. It is one of the biggest and common cybersecurity threats these days. 
 
Hackers reportedly have posted images online of a contract for Madonna's World Tour 2019-20 complete with signatures from an employee and concert company Live Nation. 
 
Another image shows a screenshot of the stolen data directory with folders named under certain clients including Bruce Springsteen.

Cybersecurity experts state that a sample of stolen data is often shared to prove that a hack has taken place which puts pressure on the victim to pay up a ransom.

The official website of an A-list law firm, which has several celebrity clients like Lady Gaga, Robert DeNiro, Elton John and others, has been hacked. The website for Grubman Shire Meiselas & Sacks is down and hackers have claimed to have access to 756 gigabytes of data including contracts and personal emails.

The official website of an A-list law firm, which has several celebrity clients like Lady Gaga, Robert DeNiro, Elton John and others, has been hacked. The website for Grubman Shire Meiselas & Sacks is down and hackers have claimed to have access to 756 gigabytes of data including contracts and personal emails. A screenshot allegedly of a contract of popstar Madonna has been released and the hackers are now demanding payment. The New York-based firm states it has notified its clients and is working with cyber-security experts. It is not known yet how much the hackers are demanding or if the law firm is negotiating with them. In a statement released to the press, the firm states, “We can confirm that we've been victimized by a cyber-attack. We have notified our clients and our staff. We have hired the world's experts who specialise in this area, and we are working around the clock to address these matters." The company's website is displaying just a logo but historic records of the site show a client list of more than 200 high profile people and companies. Some of the world’s most prominent celebrities are handled by the law firm which includes musicians Sir Elton John, Barbra Streisand, Barry Manilow, Rod Stewart, Lady Gaga, Lil Nas X, The Weeknd, Madonna, U2 and Drake. Priyanka Chopra, Robert De Niro, Sofia Vergara, and Mike Tyson are also part of the film’s clientele. he hackers have been identified as REvil or Sodinokibi who previously attacked foreign exchange company Travelex in January. That case was too, was ransomware. Ransomware is typically a malicious type of software that encrypts data until a ransom is paid, usually in untraceable crypto-currency Bitcoin. It is one of the biggest and common cybersecurity threats these days. Hackers reportedly have posted images online of a contract for Madonna's World Tour 2019-20 complete with signatures from an employee and concert company Live Nation. Another image shows a screenshot of the stolen data directory with folders named under certain clients including Bruce Springsteen. Cybersecurity experts state that a sample of stolen data is often shared to prove that a hack has taken place which puts pressure on the victim to pay up a ransom.

Website of a high-profile law firm hacked, clients include celebrities like Lady Gaga, Priyanka Chopra

Britain said on Friday it believed North Korea was behind the WannaCry&nbsp;cyber attack in May that disrupted businesses and government services worldwide, including the National Health Service (NHS) in England.

Security Minister Ben Wallace said Britain believed quite strongly&nbsp;that the ransomware attack came from a foreign state.&nbsp;

&quot;North Korea was the state that we believe was involved in this worldwide attack on our systems&quot; he told BBC radio.

&quot;We can be as sure as possible - I can`t obviously go into the detailed intelligence but it is widely believed in the community and across a number of countries that North Korea had taken this role.&quot;

WannaCry infected more than 300,000 computers in 150 countries in a matter of days, demanding victims pay ransoms starting at $300 to regain access to their machines.

Cyber security researchers quickly identified a possible link to North Korea.

More than a third of England&#39;s 236 NHS trusts and an estimated 19,000 appointments were affected, Britain`s National Audit Office said on Friday in a report on the attack.

It also said that WannaCry was a relatively unsophisticated attack that could have been prevented by the NHS had it followed basic IT security best practice.

No NHS organisation had paid the ransom but the government did&nbsp;not know how much the disruption to services costed the NHS.&nbsp;

Wallace said Britain needed to redouble its efforts to strengthen cyber security.

&quot;It&#39;s a salient lesson for us all that all of us, from individuals to governments to large organisations, have a role to play in maintaining the security of our networks,&quot; he said.&nbsp;

Security Minister Ben Wallace said Britain believed quite strongly?that the ransomware attack came from a foreign state.

Britain said on Friday it believed North Korea was behind the WannaCry cyber attack in May that disrupted businesses and government services worldwide, including the National Health Service (NHS) in England. Security Minister Ben Wallace said Britain believed quite strongly that the ransomware attack came from a foreign state. "North Korea was the state that we believe was involved in this worldwide attack on our systems" he told BBC radio. "We can be as sure as possible - I can`t obviously go into the detailed intelligence but it is widely believed in the community and across a number of countries that North Korea had taken this role." WannaCry infected more than 300,000 computers in 150 countries in a matter of days, demanding victims pay ransoms starting at $300 to regain access to their machines. Cyber security researchers quickly identified a possible link to North Korea. More than a third of England's 236 NHS trusts and an estimated 19,000 appointments were affected, Britain`s National Audit Office said on Friday in a report on the attack. It also said that WannaCry was a relatively unsophisticated attack that could have been prevented by the NHS had it followed basic IT security best practice. No NHS organisation had paid the ransom but the government did not know how much the disruption to services costed the NHS. Wallace said Britain needed to redouble its efforts to strengthen cyber security. "It's a salient lesson for us all that all of us, from individuals to governments to large organisations, have a role to play in maintaining the security of our networks," he said.

Britain believes North Korea was behind ransomware 'WannaCry' NHS cyber attack

A British computer security researcher hailed as a hero for thwarting the &quot;WannaCry&quot; ransomware onslaught was in US custody on Thursday after being indicted on charges of creating malware to attack banks.

Marcus Hutchins, known by the alias &quot;Malwaretech,&quot; was charged in an indictment dated July 12 and unsealed this week by federal authorities in Wisconsin.

The US Justice Department said in a statement Hutchins was arrested Wednesday in Las Vegas, where a major Def Con hacker security conference took place over the weekend.

Twitter postings from other security researchers said he was detained as he prepared to fly back to Britain.

Hutchins faces criminal charges including conspiracy to commit computer fraud, according to the US Department of Justice.

The indictment accuses Hutchins and another individual of making and distributing Kronos &quot;banking Trojan,&quot; a reference to malicious software designed to steal user names and passwords used at online banking sites.

Since it was created, Kronos has been configured to work on banking systems in Britain, Canada, Germany, Poland, France, and other countries, according to the DOJ.

The indictment set the time of the activity by Hutchins as being from July 2014 to July of the following year.

&#39;Dark markets&#39;

Hutchins was part of a conspiracy to distribute the hacking tool on so-called dark markets, according to the indictment signed last month by US Attorney Gregory Haanstad.

Kronos was evidently first made available through certain internet forums in early 2014, and was marketed and distributed through a hidden online AlphaBay marketplace, according to US prosecutors.

AlphaBay was shut down by US and European police in a crackdown on two huge &quot;dark web&quot; marketplaces that allowed the anonymous online trade of drugs, hacking software and guns.

The timing of the indictment of Hutchins raises questions as to whether insights mined from the AlphaBay probe lead to his arrest.

Underground websites AlphaBay and Hansa Market had tens of thousands of sellers of deadly drugs like fentanyl and other illicit goods serving more than 200,000 customers worldwide.

AlphaBay, the largest dark web market, had been run out of Thailand, and filled a gap left behind by the notorious Silk Road online market, shut down by authorities in 2013.

Officials at the time said shutting down the two markets and the arrests of administrators enabled them to collect extensive intelligence on buyers and sellers, including criminal gangs. Their names were being distributed to law enforcement in 37 countries.

From hero to accused

Lawyers at the San Francisco-based online rights group Electronic Frontier Foundation said they were looking to contact Hutchins.

&quot;The EFF is deeply concerned about the arrest of Marcus Hutchins, a security researcher known for shutting down the WannaCry ransomware. We are looking into the matter, and are reaching out to Hutchins,&quot; a statement from the group said.

A spokesperson for the British Embassy in Washington said only that they &quot;are in touch with local authorities in Las Vegas following reports of a British man being arrested.&quot;

Hutchins was hailed as a hero in May for finding and triggering a &quot;kill switch&quot; for a WannaCry ransomware attack that was spreading wildly around the world, locking away data on computers and demanding money for its release.

Andrew Mabbitt, another security researcher who was with Hutchins in Las Vegas, said he did not believe the allegations.

&quot;He spent his career stopping malware, not writing it,&quot; Mabbitt said on Twitter. 
&nbsp;

Marcus Hutchins, known by the alias "Malwaretech," was charged in an indictment dated July 12 and unsealed this week by federal authorities in Wisconsin

A British computer security researcher hailed as a hero for thwarting the "WannaCry" ransomware onslaught was in US custody on Thursday after being indicted on charges of creating malware to attack banks. Marcus Hutchins, known by the alias "Malwaretech," was charged in an indictment dated July 12 and unsealed this week by federal authorities in Wisconsin. The US Justice Department said in a statement Hutchins was arrested Wednesday in Las Vegas, where a major Def Con hacker security conference took place over the weekend. Twitter postings from other security researchers said he was detained as he prepared to fly back to Britain. Hutchins faces criminal charges including conspiracy to commit computer fraud, according to the US Department of Justice. The indictment accuses Hutchins and another individual of making and distributing Kronos "banking Trojan," a reference to malicious software designed to steal user names and passwords used at online banking sites. Since it was created, Kronos has been configured to work on banking systems in Britain, Canada, Germany, Poland, France, and other countries, according to the DOJ. The indictment set the time of the activity by Hutchins as being from July 2014 to July of the following year. 'Dark markets' Hutchins was part of a conspiracy to distribute the hacking tool on so-called dark markets, according to the indictment signed last month by US Attorney Gregory Haanstad. Kronos was evidently first made available through certain internet forums in early 2014, and was marketed and distributed through a hidden online AlphaBay marketplace, according to US prosecutors. AlphaBay was shut down by US and European police in a crackdown on two huge "dark web" marketplaces that allowed the anonymous online trade of drugs, hacking software and guns. The timing of the indictment of Hutchins raises questions as to whether insights mined from the AlphaBay probe lead to his arrest. Underground websites AlphaBay and Hansa Market had tens of thousands of sellers of deadly drugs like fentanyl and other illicit goods serving more than 200,000 customers worldwide. AlphaBay, the largest dark web market, had been run out of Thailand, and filled a gap left behind by the notorious Silk Road online market, shut down by authorities in 2013. Officials at the time said shutting down the two markets and the arrests of administrators enabled them to collect extensive intelligence on buyers and sellers, including criminal gangs. Their names were being distributed to law enforcement in 37 countries. From hero to accused Lawyers at the San Francisco-based online rights group Electronic Frontier Foundation said they were looking to contact Hutchins. "The EFF is deeply concerned about the arrest of Marcus Hutchins, a security researcher known for shutting down the WannaCry ransomware. We are looking into the matter, and are reaching out to Hutchins," a statement from the group said. A spokesperson for the British Embassy in Washington said only that they "are in touch with local authorities in Las Vegas following reports of a British man being arrested." Hutchins was hailed as a hero in May for finding and triggering a "kill switch" for a WannaCry ransomware attack that was spreading wildly around the world, locking away data on computers and demanding money for its release. Andrew Mabbitt, another security researcher who was with Hutchins in Las Vegas, said he did not believe the allegations. "He spent his career stopping malware, not writing it," Mabbitt said on Twitter.

Hero who stopped WannaCry attack arrested in US on separate malware charges

Ransomware demands which hit a clutch of multinationals are the latest in a wave of international cyberattacks in recent months.&nbsp;

In Europe, Danish sea transport company Maersk, British advertising giant WPP and French industrial group Saint-Gobain all came under attack as did US pharmaceutical group Merck.

The attacking tool is believed to be ransomware of the so-called Petya malware type, which earlier affected firms in Russia including oil giant Rosneft and Ukraine.

The latest wave comes just six weeks after what the EU&#39;s law enforcement agency described as an &quot;unprecedented&quot; attack by WannaCry ransomware which hit more than 100 countries, notably Britain&#39;s National Health Service.

The repeated waves of attacks have raised questions on how companies can protect themselves effectively.

- What is ransomware? -&nbsp; 
Ransomware is malicious software which locks computer files and forces users to pay the attackers a designated sum in the virtual Bitcoin currency to regain access to the files.

Ransomware is used on PCs as well as tablets and smartphones. It can affect &quot;at the same time individuals, businesses and institutions,&quot; Amar Zendik, CEO security firm Mind Technologies, told AFP.

How does it work? - 
Cyberpirates generally take control of computers by exploiting flaws on the internet.

That could happen when a user logs onto a website that has been previously infected or opens an email that invites the user to click on a link or download an attachment.

In a few seconds, the malware can be implanted. And when it&#39;s installed, &quot;it can&#39;t be detected,&quot; Laurent Marechal, a cyber security expert at McAfee, said. It&#39;s only afterward that it &quot;downloads the &#39;payload&#39;, that is the viral charge,&quot; he said.

From then on the computer workstation is blocked. &quot;Most often the user has to send an SMS&quot; -- and pay up -- &quot;in order to get the unblocking code,&quot; &nbsp;says Marechal, adding that in certain complex cases, the virus can spread &quot;without any human intervention&quot;.

- Is it used frequently? - 
Yes. And Ransomware continues to multiply. According to security software Kapersky Lab, 62 new types of ransomware were identified last year.

And the US computer security software company McAfee said the number of &quot;samples&quot; detected increased by 88 percent in 2016, totalling some four million.

&quot;Often the pirates ask for small sums of money. But accumulated, these small amounts add up to big money,&quot; says cyber security expert Zendik.

&quot;This is a bit like a flu epidemic in winter,&quot; said Nicolas Duvinage, head of the French military&#39;s digital crime unit. &quot;We will get many of these viral attack waves in coming months,&quot; he added.

&nbsp;System flaw &nbsp;- 
The culprits behind the cyberattacks in May apparently took advantage of a flaw in the Windows operating system, divulged in documents leaked from the US National Security Agency (NSA), according to initial findings.

Zendik said the attack was based on a previously unknown Windows flaw.

&quot;We&#39;re not talking about classic &#39;ransomware&#39; which generally targets individuals and small businesses,&quot; he said.

&quot;Here the hackers attacked big institutions, not likely to be susceptible to paying, especially given the publicity about the operation.&quot;

He added that &quot;in theory, the authors of the attack did not want to make money, but rather to achieve a (cyber) coup.&quot;

- How to protect oneself - 
Several simple rules can be followed to reduce the risks of a ransomware attack.

Among them are regularly updating security software which can correct any flaws exploited by the virus.

In case of a cyberattack, the authorities advise disconnecting the infected equipment immediately from the network.

In the case of a virus affecting a business or an institution, the IT experts should be alerted right away.

Authorities also recommend not paying the hackers the ransom demanded because it&#39;s no guarantee that access to the data will be restored.

Ransomware is malicious software which locks computer files and forces users to pay the attackers a designated sum in the virtual Bitcoin currency to regain access to the files

Ransomware demands which hit a clutch of multinationals are the latest in a wave of international cyberattacks in recent months. In Europe, Danish sea transport company Maersk, British advertising giant WPP and French industrial group Saint-Gobain all came under attack as did US pharmaceutical group Merck. The attacking tool is believed to be ransomware of the so-called Petya malware type, which earlier affected firms in Russia including oil giant Rosneft and Ukraine. The latest wave comes just six weeks after what the EU's law enforcement agency described as an "unprecedented" attack by WannaCry ransomware which hit more than 100 countries, notably Britain's National Health Service. The repeated waves of attacks have raised questions on how companies can protect themselves effectively. - What is ransomware? - Ransomware is malicious software which locks computer files and forces users to pay the attackers a designated sum in the virtual Bitcoin currency to regain access to the files. Ransomware is used on PCs as well as tablets and smartphones. It can affect "at the same time individuals, businesses and institutions," Amar Zendik, CEO security firm Mind Technologies, told AFP. How does it work? - Cyberpirates generally take control of computers by exploiting flaws on the internet. That could happen when a user logs onto a website that has been previously infected or opens an email that invites the user to click on a link or download an attachment. In a few seconds, the malware can be implanted. And when it's installed, "it can't be detected," Laurent Marechal, a cyber security expert at McAfee, said. It's only afterward that it "downloads the 'payload', that is the viral charge," he said. From then on the computer workstation is blocked. "Most often the user has to send an SMS" -- and pay up -- "in order to get the unblocking code," says Marechal, adding that in certain complex cases, the virus can spread "without any human intervention". - Is it used frequently? - Yes. And Ransomware continues to multiply. According to security software Kapersky Lab, 62 new types of ransomware were identified last year. And the US computer security software company McAfee said the number of "samples" detected increased by 88 percent in 2016, totalling some four million. "Often the pirates ask for small sums of money. But accumulated, these small amounts add up to big money," says cyber security expert Zendik. "This is a bit like a flu epidemic in winter," said Nicolas Duvinage, head of the French military's digital crime unit. "We will get many of these viral attack waves in coming months," he added. System flaw - The culprits behind the cyberattacks in May apparently took advantage of a flaw in the Windows operating system, divulged in documents leaked from the US National Security Agency (NSA), according to initial findings. Zendik said the attack was based on a previously unknown Windows flaw. "We're not talking about classic 'ransomware' which generally targets individuals and small businesses," he said. "Here the hackers attacked big institutions, not likely to be susceptible to paying, especially given the publicity about the operation." He added that "in theory, the authors of the attack did not want to make money, but rather to achieve a (cyber) coup." - How to protect oneself - Several simple rules can be followed to reduce the risks of a ransomware attack. Among them are regularly updating security software which can correct any flaws exploited by the virus. In case of a cyberattack, the authorities advise disconnecting the infected equipment immediately from the network. In the case of a virus affecting a business or an institution, the IT experts should be alerted right away. Authorities also recommend not paying the hackers the ransom demanded because it's no guarantee that access to the data will be restored.

Ransomware, the weapon wielded in cyber attacks

A global ransomware attack hit computers at Russia&#39;s biggest oil company, Ukraine&#39;s international airport, global shipping firm A.P. Moller-Maersk and the world&#39;s biggest advertising agency.

Following is a list of companies and organisations that have reported being hit by cyber attacks:

ROSNEFT

Russia&#39;s top oil producer Rosneft said its servers had been hit by a large-scale cyber attack but its oil production was unaffected.

AP&nbsp;MOLLER-MAERSK

Danish shipping giant A.P. Moller-Maersk, which handles one out of seven containers shipped globally, said a cyber attack had caused outages at its computer systems across the world.

Maersk&#39;s port operator APM Terminals was also hit. Dutch broadcaster RTV Rijnmond reported that 17 shipping container terminals run by APM Terminals had been hacked, including two in Rotterdam and 15 in other parts of the world.

WPP

Britain&#39;s WPP, the world&#39;s biggest advertising company, said computer systems within several of its agencies had been hit by a suspected cyber attack.

MERCK &amp; CO

Pharmaceutical company Merck tweeted its computer network was compromised as part of a global hack.

RUSSIAN BANKS

Russia&#39;s central bank said there had been &quot;computer attacks&quot; on Russian banks and that in isolated cases their IT systems had been infected.

All Russian branches of Home Credit consumer lender are closed because of a cyber attack, an employee of a Home Credit call centre in Russia said.

UKRAINIAN BANKS, POWER GRID

A number of Ukrainian banks and companies, including the state power distributor, were hit by a cyber attack that disrupted some operations, the Ukrainian central bank said.

UKRAINIAN INTERNATIONAL AIRPORT

Yevhen Dykhne, director of the capital&#39;s Boryspil Airport, said it had been hit. &quot;In connection with the irregular situation, some flight delays are possible.&quot; 
SAINT GOBAIN

French construction materials company Saint Gobain said it had been a victim of a cyber attack, and it had isolated its computer systems to protect data.

DEUTSCHE POST

German postal and logistics company Deutsche Post said systems of its Express division in the Ukraine have in part been affected by a cyber attack.

METRO

Germany&#39;s Metro said its wholesale stores in the Ukraine had been hit by a cyber attack and the retailer was assessing the impact.

MONDELEZ INTERNATIONAL

Food company Mondelez International said employees in different regions were experiencing technical problems but it was unclear whether this was due to a cyber attack.

TNT EXPRESS

The Netherlands-based shipping company said it was experiencing interference with some of its systems, following a global ransomware attack.

EVRAZ

Russian steelmaker Evraz said its information systems had been hit by a cyber attack but its output was not affected.

NORWAY

A ransomware cyber attack is taking place in Norway and is affecting an unnamed international company, the Nordic country&#39;s national security authority.

MARS

A unit of candy manufacturer Mars has been targeted by cyber attackers, and the company has isolated the issue, a spokeswoman for the company said.

BEIERSDORF AG

India-based employees at Beiersdorf AG, the maker of Nivea skin care products reported that the ransomware attack had impacted some of the company&#39;s systems in the country. The extent of the impact was unclear and Beiersdorf, which is based in Germany, could not be reached immediately for comment in India.

RECKITT BENCKISER

The Indian unit of British consumer goods company Reckitt Benckiser Group, which owns brands such as Enfamil, Dettol, and Lysol, was also hit by the ransomware attack, employees in India said. The extent of the impact on its systems was not immediately clear and the company could not be reached for comment in India.

A global ransomware attack hit computers at Russia's biggest oil company, Ukraine's international airport, global shipping firm AP Moller-Maersk and the world's biggest advertising agency

A global ransomware attack hit computers at Russia's biggest oil company, Ukraine's international airport, global shipping firm A.P. Moller-Maersk and the world's biggest advertising agency. Following is a list of companies and organisations that have reported being hit by cyber attacks: ROSNEFT Russia's top oil producer Rosneft said its servers had been hit by a large-scale cyber attack but its oil production was unaffected. AP MOLLER-MAERSK Danish shipping giant A.P. Moller-Maersk, which handles one out of seven containers shipped globally, said a cyber attack had caused outages at its computer systems across the world. Maersk's port operator APM Terminals was also hit. Dutch broadcaster RTV Rijnmond reported that 17 shipping container terminals run by APM Terminals had been hacked, including two in Rotterdam and 15 in other parts of the world. WPP Britain's WPP, the world's biggest advertising company, said computer systems within several of its agencies had been hit by a suspected cyber attack. MERCK & CO Pharmaceutical company Merck tweeted its computer network was compromised as part of a global hack. RUSSIAN BANKS Russia's central bank said there had been "computer attacks" on Russian banks and that in isolated cases their IT systems had been infected. All Russian branches of Home Credit consumer lender are closed because of a cyber attack, an employee of a Home Credit call centre in Russia said. UKRAINIAN BANKS, POWER GRID A number of Ukrainian banks and companies, including the state power distributor, were hit by a cyber attack that disrupted some operations, the Ukrainian central bank said. UKRAINIAN INTERNATIONAL AIRPORT Yevhen Dykhne, director of the capital's Boryspil Airport, said it had been hit. "In connection with the irregular situation, some flight delays are possible." SAINT GOBAIN French construction materials company Saint Gobain said it had been a victim of a cyber attack, and it had isolated its computer systems to protect data. DEUTSCHE POST German postal and logistics company Deutsche Post said systems of its Express division in the Ukraine have in part been affected by a cyber attack. METRO Germany's Metro said its wholesale stores in the Ukraine had been hit by a cyber attack and the retailer was assessing the impact. MONDELEZ INTERNATIONAL Food company Mondelez International said employees in different regions were experiencing technical problems but it was unclear whether this was due to a cyber attack. TNT EXPRESS The Netherlands-based shipping company said it was experiencing interference with some of its systems, following a global ransomware attack. EVRAZ Russian steelmaker Evraz said its information systems had been hit by a cyber attack but its output was not affected. NORWAY A ransomware cyber attack is taking place in Norway and is affecting an unnamed international company, the Nordic country's national security authority. MARS A unit of candy manufacturer Mars has been targeted by cyber attackers, and the company has isolated the issue, a spokeswoman for the company said. BEIERSDORF AG India-based employees at Beiersdorf AG, the maker of Nivea skin care products reported that the ransomware attack had impacted some of the company's systems in the country. The extent of the impact was unclear and Beiersdorf, which is based in Germany, could not be reached immediately for comment in India. RECKITT BENCKISER The Indian unit of British consumer goods company Reckitt Benckiser Group, which owns brands such as Enfamil, Dettol, and Lysol, was also hit by the ransomware attack, employees in India said. The extent of the impact on its systems was not immediately clear and the company could not be reached for comment in India.

Companies hit by global ransomware attack on June 27

London&#39;s Heathrow airport said early on Monday that there were still some disruptions to <a href="https://www.wionews.com/world/british-airways-cancels-all-saturday-flights-from-londons-heathrow-gatwick-after-it-failure-16114">British Airways flights from the airport following a global computer system</a> failure at the airline.

London&#39;s Heathrow and&nbsp;Gatwick airports were closed for the whole day on Saturday after a power supply problem disrupted its flight operations worldwide and also hit its call centres and website&nbsp;leading to large-scale flight disruptions leaving several thousand passengers stranded at the two airports.&nbsp;

BA said on Twitter it would run a full schedule at London&#39;s Gatwick on Monday and intended to operate a full long-haul schedule from Heathrow along with a high proportion of short-haul service.

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<blockquote class="twitter-tweet" data-lang="en">
On Monday, we will run a full schedule at Gatwick and intend to operate a full long-haul schedule from Heathrow 1/4
&mdash; British Airways (@British_Airways) <a href="https://twitter.com/British_Airways/status/868989859612033024">May 29, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script></div>
<a class="close-mark close-div" href="#" id="jqclosemark">&times;</a></div>

&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<blockquote class="twitter-tweet" data-lang="en">
with a high proportion of our short-haul programme. We apologise again to customers for the frustration and inconvenience 2/4
&mdash; British Airways (@British_Airways) <a href="https://twitter.com/British_Airways/status/868990340459634689">May 29, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script></div>
<a class="close-mark close-div" href="#" id="jqclosemark">&times;</a></div>

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<blockquote class="twitter-tweet" data-lang="en">
they are experiencing and we thank them for their continued patience. We urge customers due to travel today 3/4
&mdash; British Airways (@British_Airways) <a href="https://twitter.com/British_Airways/status/868990544457936898">May 29, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script></div>
<a class="close-mark close-div" href="#" id="jqclosemark">&times;</a></div>

The airline resumed some flights from Britain&#39;s two biggest airports on Sunday, but hundreds of passengers were still waiting for hours at London Heathrow.

&quot;We have mobilized additional Heathrow colleagues to assist passengers at the terminals and give out free water and snacks,&quot; Heathrow said in a statement on Twitter.

The airport had said earlier that further delays and cancellations of BA flights were expected on Sunday and told passengers not to travel to the airport unless they were rebooked on other flights.

(Reuters)

British Airways said it would run a full schedule at London's Gatwick on Monday

London's Heathrow airport said early on Monday that there were still some disruptions to British Airways flights from the airport following a global computer system failure at the airline. London's Heathrow and Gatwick airports were closed for the whole day on Saturday after a power supply problem disrupted its flight operations worldwide and also hit its call centres and website leading to large-scale flight disruptions leaving several thousand passengers stranded at the two airports. BA said on Twitter it would run a full schedule at London's Gatwick on Monday and intended to operate a full long-haul schedule from Heathrow along with a high proportion of short-haul service. On Monday, we will run a full schedule at Gatwick and intend to operate a full long-haul schedule from Heathrow 1/4 — British Airways (@British_Airways) May 29, 2017 × with a high proportion of our short-haul programme. We apologise again to customers for the frustration and inconvenience 2/4 — British Airways (@British_Airways) May 29, 2017 × they are experiencing and we thank them for their continued patience. We urge customers due to travel today 3/4 — British Airways (@British_Airways) May 29, 2017 × The airline resumed some flights from Britain's two biggest airports on Sunday, but hundreds of passengers were still waiting for hours at London Heathrow. "We have mobilized additional Heathrow colleagues to assist passengers at the terminals and give out free water and snacks," Heathrow said in a statement on Twitter. The airport had said earlier that further delays and cancellations of BA flights were expected on Sunday and told passengers not to travel to the airport unless they were rebooked on other flights. (Reuters)

After IT shutdown, British Airways still experiencing disruptions at Heathrow

British Airways has&nbsp;cancelled all flights out of major London airports Heathrow and Gatwick for the rest of Saturday after an IT systems failure.

The airline had earlier said all flights from the two airports had been cancelled up to 6.00 pm (1700 GMT), but a spokesman later told AFP that all flights for Saturday had been grounded.

The latest IT failure comes just a few weeks after the ransomware attack which had <a href="http://www.wionews.com/world/multiple-countries-reporting-ransomware-cyber-attacks-15509">paralysed&nbsp;Britain&#39;s health services for several hours</a>.&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<blockquote class="twitter-tweet" data-lang="en">
We apologise for the current IT systems outage. We are working to resolve the problem as quickly as possible.
&mdash; British Airways (@British_Airways) <a href="https://twitter.com/British_Airways/status/868403485729071104">May 27, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script></div>
<a class="close-mark close-div" href="#" id="jqclosemark">&times;</a></div>

The airline said it had found &quot;no evidence that it&#39;s a cyber attack&quot;.&nbsp;

&quot;We have experienced a major IT system failure that is causing very severe disruption to our flight operations worldwide,&quot; BA said in a statement.

&quot;The terminals at Heathrow and Gatwick have become extremely congested and we have cancelled all flights from Heathrow and Gatwick before 6.00 pm UK time today (1700 GMT), so please do not come to the airports.&quot;

The airline had suffered previous IT glitches, with passengers hit by severe delays in July and September last year.&nbsp;

Distressed&nbsp;passengers immediately took to Twitter expressing their discomfort, several said&nbsp;that they were unable to check in or use the airline&#39;s app while others were left grounded on the tarmac.

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<blockquote class="twitter-tweet" data-lang="en">
Chaos at Heathrow - BA system problems apparently so severe that staff having to write gate information on white boards (pic: <a href="https://twitter.com/theboyg">@theboyg</a>) <a href="https://t.co/0nGX16QH5F">pic.twitter.com/0nGX16QH5F</a>
&mdash; Stephen Jones (@SteveJonesPA) <a href="https://twitter.com/SteveJonesPA/status/868412388235763713">May 27, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script></div>
<a class="close-mark close-div" href="#" id="jqclosemark">&times;</a></div>

(WION with AFP inputs)

&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="videos-block">
<div class="embed-responsive embed-responsive-16by9"><iframe class="embed-responsive-item" src="https://www.youtube.com/embed/S8bzSmyg0fQ"></iframe></div>
</div>

<div class="media-description">
British Airways flights in Britain were being delayed and passengers were suffering long waits at airports on Saturday because of an IT system failure (WION)
</div>
<a class="close-mark close-div" href="#" id="jqclosemark">&times;</a></div>

&nbsp;

British Airways said it had found "no evidence that it's a cyber attack

British Airways has cancelled all flights out of major London airports Heathrow and Gatwick for the rest of Saturday after an IT systems failure. The airline had earlier said all flights from the two airports had been cancelled up to 6.00 pm (1700 GMT), but a spokesman later told AFP that all flights for Saturday had been grounded. The latest IT failure comes just a few weeks after the ransomware attack which had paralysed Britain's health services for several hours. We apologise for the current IT systems outage. We are working to resolve the problem as quickly as possible. — British Airways (@British_Airways) May 27, 2017 × The airline said it had found "no evidence that it's a cyber attack". "We have experienced a major IT system failure that is causing very severe disruption to our flight operations worldwide," BA said in a statement. "The terminals at Heathrow and Gatwick have become extremely congested and we have cancelled all flights from Heathrow and Gatwick before 6.00 pm UK time today (1700 GMT), so please do not come to the airports." The airline had suffered previous IT glitches, with passengers hit by severe delays in July and September last year. Distressed passengers immediately took to Twitter expressing their discomfort, several said that they were unable to check in or use the airline's app while others were left grounded on the tarmac. Chaos at Heathrow - BA system problems apparently so severe that staff having to write gate information on white boards (pic: @theboyg) pic.twitter.com/0nGX16QH5F — Stephen Jones (@SteveJonesPA) May 27, 2017 × (WION with AFP inputs) British Airways flights in Britain were being delayed and passengers were suffering long waits at airports on Saturday because of an IT system failure (WION) ×

British Airways cancels all Saturday flights from London's Heathrow, Gatwick after IT failure

China has urged Windows users to protect themselves against a new ransomware virus similar to the WannaCry bug that wreaked havoc worldwide last week.

&quot;UIWIX&quot; encrypts and renames files through a bug in the Windows operating system, China&#39;s National Computer Virus Emergency Response Center (CVERC) warned in a public announcement Wednesday, telling users to install the latest Microsoft update.

The warning comes on the heels of the &quot;WannaCry&quot; cyberattack, which has hit hundreds of thousands of computers worldwide.

While no UIWIX infections have yet been detected in China, the virus has spread in other countries and prompted a security alert last week from the Danish cybersecurity company Heimdal Security.

&quot;UIWIX ransomware is picking up where the first WannaCry wave left off, without a kill switch domain and the same self-replicating abilities that enable it to spread fast,&quot; the firm said in a statement.

Heimdal cautioned that the new bug could be more powerful than WannaCry due to the absence of a kill switch domain that could contain the virus&#39;s distribution.

But other analysts have noted that UIWIX appears to be spreading at a much slower pace.

Global cybersecurity firm Proofpoint warned on Wednesday about another large-scale, stealthy cyberattack linked to WannaCry called Adylkuzz.

The extent of Wannacry&#39;s impact in China remains unclear.

On Sunday, Qihoo 360, one of China&#39;s leading suppliers of anti-virus software, said more than 29,000 institutions ranging from government offices to ATMs and hospitals had been &quot;infected&quot; by Wannacry, singling out universities as particularly hard-hit.

But the Education Ministry&#39;s China Education and Research Network denied that there had been widespread damage to computer systems, saying only 66 out of 1,600 Chinese universities were affected.

Sarah Larson, a politics and cybersecurity researcher at the University of New South Wales, told AFP that China&#39;s preemptive alert about UIWIX may indicate that WannaCry sent the government &quot;reeling.&quot;

Larson said China is particularly vulnerable to malicious code because the majority of the country&#39;s computer users are reliant on pirated software.

&quot;Until now the government has done little to encourage the use of legitimate software,&quot; she said.

&quot;This reluctance is largely caused by a type of cyber sovereignty directed at the dominance of US tech companies like Microsoft.&quot;

Severine Arsene, an Internet expert at the French Centre for Research on Contemporary China, said the announcement, which noted the virus was &quot;detected abroad,&quot; is in line with China&#39;s current rhetoric around cybersecurity.

&quot;China has long claimed that they are a major victim of cyber attacks every year,&quot; Arsene told AFP, &quot;whereas they are essentially portrayed as a source of cyberattacks by foreign media.&quot;

The warning is intended &quot;to publicly show that they are taking responsibility to help maintain security and stability online&quot;.

The government will implement on June 1 a controversial cybersecurity bill tightening restrictions on online freedom of speech and imposing new rules on online service providers.

Fifty-four international trade groups signed a letter Monday calling on China to reconsider the law, arguing that it would create significant obstacles for foreign businesses.

(AFP)

The warning comes on the heels of the 'WannaCry' cyberattack, which has hit hundreds of thousands of computers worldwide

China has urged Windows users to protect themselves against a new ransomware virus similar to the WannaCry bug that wreaked havoc worldwide last week. "UIWIX" encrypts and renames files through a bug in the Windows operating system, China's National Computer Virus Emergency Response Center (CVERC) warned in a public announcement Wednesday, telling users to install the latest Microsoft update. The warning comes on the heels of the "WannaCry" cyberattack, which has hit hundreds of thousands of computers worldwide. While no UIWIX infections have yet been detected in China, the virus has spread in other countries and prompted a security alert last week from the Danish cybersecurity company Heimdal Security. "UIWIX ransomware is picking up where the first WannaCry wave left off, without a kill switch domain and the same self-replicating abilities that enable it to spread fast," the firm said in a statement. Heimdal cautioned that the new bug could be more powerful than WannaCry due to the absence of a kill switch domain that could contain the virus's distribution. But other analysts have noted that UIWIX appears to be spreading at a much slower pace. Global cybersecurity firm Proofpoint warned on Wednesday about another large-scale, stealthy cyberattack linked to WannaCry called Adylkuzz. The extent of Wannacry's impact in China remains unclear. On Sunday, Qihoo 360, one of China's leading suppliers of anti-virus software, said more than 29,000 institutions ranging from government offices to ATMs and hospitals had been "infected" by Wannacry, singling out universities as particularly hard-hit. But the Education Ministry's China Education and Research Network denied that there had been widespread damage to computer systems, saying only 66 out of 1,600 Chinese universities were affected. Sarah Larson, a politics and cybersecurity researcher at the University of New South Wales, told AFP that China's preemptive alert about UIWIX may indicate that WannaCry sent the government "reeling." Larson said China is particularly vulnerable to malicious code because the majority of the country's computer users are reliant on pirated software. "Until now the government has done little to encourage the use of legitimate software," she said. "This reluctance is largely caused by a type of cyber sovereignty directed at the dominance of US tech companies like Microsoft." Severine Arsene, an Internet expert at the French Centre for Research on Contemporary China, said the announcement, which noted the virus was "detected abroad," is in line with China's current rhetoric around cybersecurity. "China has long claimed that they are a major victim of cyber attacks every year," Arsene told AFP, "whereas they are essentially portrayed as a source of cyberattacks by foreign media." The warning is intended "to publicly show that they are taking responsibility to help maintain security and stability online". The government will implement on June 1 a controversial cybersecurity bill tightening restrictions on online freedom of speech and imposing new rules on online service providers. Fifty-four international trade groups signed a letter Monday calling on China to reconsider the law, arguing that it would create significant obstacles for foreign businesses. (AFP)

China warns Windows users of fresh ransomware virus attack

Governments turned their attention to a possible new wave of cyber threats after the group that leaked US&nbsp;hacking tools used to launch the global WannaCry &quot;ransomware&quot; attack warned it would release more malicious code.

The fast-spreading cyber extortion campaign, which has infected more than 3,00,000 computers worldwide since Friday, eased for second day on Tuesday, but the identity and motive of its creators remain unknown.

The attack includes elements that belong to the US&nbsp;National Security Agency and were leaked online last month.

Shadow Brokers, the group that has taken credit for that leak, threatened on Tuesday to release more recent code to enable hackers to break into the world&#39;s most widely used computers, software and phones.

A blog post written by the group promised from June to release tools every month to anyone willing to pay for access to some of the tech world&#39;s biggest commercial secrets.

It also threatened to dump data from banks using the SWIFT international money transfer network and from Russian, Chinese, Iranian or North Korean nuclear and missile programs. &quot;More details in June,&quot; it promised.

The spread of the WannaCry attack - which encrypts a user&#39;s data and demands a &quot;ransom&quot; be paid electronically to free it up again - slowed to a trickle on Tuesday, with few, isolated examples being reported.

In Canada, the Universite de Montreal was hit, with 120 of the French-language university&rsquo;s 8,300 computers affected, according to a university spokeswoman.

There were no new, major incidents in the United States. Fewer than 10 US&nbsp;organisations have reported attacks to the Department of Homeland Security since Friday, a US&nbsp;official told reporters on Tuesday.

The attack has caused most damage in Russia, Taiwan, Ukraine and India, according to Czech security firm Avast.

The United States likely avoided greater harm as the attack targeted older versions of Microsoft&#39;s Windows operating system, and more US&nbsp;users have licensed, up-to-date, patched versions of the software, compared to other regions of the world.

The Department of Homeland Security began an &quot;aggressive awareness campaign&quot; to alert the tech industry to the importance of installing the patch that Microsoft issued in March that protected users from the vulnerability exploited by the attack, a US&nbsp;official working on the attack told Reuters.

Microsoft said on Tuesday it was aware of Shadow Brokers&#39; most recent claim and that its security teams monitor potential threats in order to &quot;help us prioritise and take appropriate action.&quot;

Microsoft President and Chief Legal Officer Brad Smith said earlier this week the WannaCry attack used elements stolen from the NSA. The US&nbsp;government has not commented directly on the matter.

North Korea link probed

Cyber security researchers around the world have said they have found evidence that could link North Korea with the WannaCry cyber attack.

A researcher from South Korea&#39;s Hauri Labs said on Tuesday their own findings matched those of Symantecand Kaspersky, who said on Monday that some code in an earlier version of the WannaCry software had also appeared in programs used by the Lazarus Group, identified by some researchers as a North Korea-run hacking operation.

&quot;It is similar to North Korea&#39;s backdoor malicious codes,&quot; said Simon Choi, a senior researcher with Hauri who has done extensive research into North Korea&#39;s hacking capabilities and advises South Korean police and National Intelligence Service.

Both Symantec and Kaspersky said it was too early to tell whether North Korea was involved in the attacks, based on the evidence that was published on Twitter by Google security researcher Neel Mehta.

FireEye, another large cyber security firm, said it was also investigating, but it was cautious about drawing a link to North Korea.

&quot;The similarities we see between malware linked to that group and WannaCry are not unique enough to be strongly suggestive of a common operator,&quot; FireEye researcher John Miller said.

US&nbsp;and European security officials told Reuters on condition of anonymity that it was too early to say who might be behind the attacks, but they did not rule out North Korea as a suspect.

The Lazarus hackers, acting for impoverished North Korea, have been more brazen in their pursuit of financial gain than others, and have been blamed for the theft of $81 million from the Bangladesh central bank, according to some cyber security firms. The United States accused it of being behind a cyber attack on Sony Pictures in 2014.

North Korea has denied being behind the Sony and banking attacks. North Korean officials were not immediately available for comment and its state media has been quiet about the matter.

No information to share

In China, foreign ministry spokeswoman Hua Chunying said she had no information to share, when asked about the origin of the attack and whether North Korea might be connected.

Several Asian countries have been affected by the malware, although the impact has not been as widespread as some had feared.

In Malaysia, cyber security firm LE Global Services said it identified 12 cases so far, including a large government-linked corporation, a government-linked investment firm and an insurance company. It did not name any of the entities.

&quot;We may not see the real picture yet, as companies are not mandated to disclose security breaches to authorities in Malaysia,&quot; said LE Global CEO Fong Choong Fook.

&quot;The real situation may be serious. In one of the cases, the attack was traced back to early April.&quot;

Vietnam&#39;s state media said on Tuesday more than 200 computers had been affected, but one of the country&#39;s leading anti virus companies, Bkav, later put the figure at 1,900.

Taiwan Power said that nearly 800 of its computers were affected, although these were used for administration, not for systems involved in electricity generation.

(Reuters)

The fast-spreading cyber extortion campaign has infected more than 300,000 computers worldwide

Governments turned their attention to a possible new wave of cyber threats after the group that leaked US hacking tools used to launch the global WannaCry "ransomware" attack warned it would release more malicious code. The fast-spreading cyber extortion campaign, which has infected more than 3,00,000 computers worldwide since Friday, eased for second day on Tuesday, but the identity and motive of its creators remain unknown. The attack includes elements that belong to the US National Security Agency and were leaked online last month. Shadow Brokers, the group that has taken credit for that leak, threatened on Tuesday to release more recent code to enable hackers to break into the world's most widely used computers, software and phones. A blog post written by the group promised from June to release tools every month to anyone willing to pay for access to some of the tech world's biggest commercial secrets. It also threatened to dump data from banks using the SWIFT international money transfer network and from Russian, Chinese, Iranian or North Korean nuclear and missile programs. "More details in June," it promised. The spread of the WannaCry attack - which encrypts a user's data and demands a "ransom" be paid electronically to free it up again - slowed to a trickle on Tuesday, with few, isolated examples being reported. In Canada, the Universite de Montreal was hit, with 120 of the French-language university’s 8,300 computers affected, according to a university spokeswoman. There were no new, major incidents in the United States. Fewer than 10 US organisations have reported attacks to the Department of Homeland Security since Friday, a US official told reporters on Tuesday. The attack has caused most damage in Russia, Taiwan, Ukraine and India, according to Czech security firm Avast. The United States likely avoided greater harm as the attack targeted older versions of Microsoft's Windows operating system, and more US users have licensed, up-to-date, patched versions of the software, compared to other regions of the world. The Department of Homeland Security began an "aggressive awareness campaign" to alert the tech industry to the importance of installing the patch that Microsoft issued in March that protected users from the vulnerability exploited by the attack, a US official working on the attack told Reuters. Microsoft said on Tuesday it was aware of Shadow Brokers' most recent claim and that its security teams monitor potential threats in order to "help us prioritise and take appropriate action." Microsoft President and Chief Legal Officer Brad Smith said earlier this week the WannaCry attack used elements stolen from the NSA. The US government has not commented directly on the matter. North Korea link probed Cyber security researchers around the world have said they have found evidence that could link North Korea with the WannaCry cyber attack. A researcher from South Korea's Hauri Labs said on Tuesday their own findings matched those of Symantecand Kaspersky, who said on Monday that some code in an earlier version of the WannaCry software had also appeared in programs used by the Lazarus Group, identified by some researchers as a North Korea-run hacking operation. "It is similar to North Korea's backdoor malicious codes," said Simon Choi, a senior researcher with Hauri who has done extensive research into North Korea's hacking capabilities and advises South Korean police and National Intelligence Service. Both Symantec and Kaspersky said it was too early to tell whether North Korea was involved in the attacks, based on the evidence that was published on Twitter by Google security researcher Neel Mehta. FireEye, another large cyber security firm, said it was also investigating, but it was cautious about drawing a link to North Korea. "The similarities we see between malware linked to that group and WannaCry are not unique enough to be strongly suggestive of a common operator," FireEye researcher John Miller said. US and European security officials told Reuters on condition of anonymity that it was too early to say who might be behind the attacks, but they did not rule out North Korea as a suspect. The Lazarus hackers, acting for impoverished North Korea, have been more brazen in their pursuit of financial gain than others, and have been blamed for the theft of $81 million from the Bangladesh central bank, according to some cyber security firms. The United States accused it of being behind a cyber attack on Sony Pictures in 2014. North Korea has denied being behind the Sony and banking attacks. North Korean officials were not immediately available for comment and its state media has been quiet about the matter. No information to share In China, foreign ministry spokeswoman Hua Chunying said she had no information to share, when asked about the origin of the attack and whether North Korea might be connected. Several Asian countries have been affected by the malware, although the impact has not been as widespread as some had feared. In Malaysia, cyber security firm LE Global Services said it identified 12 cases so far, including a large government-linked corporation, a government-linked investment firm and an insurance company. It did not name any of the entities. "We may not see the real picture yet, as companies are not mandated to disclose security breaches to authorities in Malaysia," said LE Global CEO Fong Choong Fook. "The real situation may be serious. In one of the cases, the attack was traced back to early April." Vietnam's state media said on Tuesday more than 200 computers had been affected, but one of the country's leading anti virus companies, Bkav, later put the figure at 1,900. Taiwan Power said that nearly 800 of its computers were affected, although these were used for administration, not for systems involved in electricity generation. (Reuters)

WannaCry: Cyber attack eases, but hacking group threatens to sell code

Chinese local authorities from traffic police to industry regulators were hobbled on Monday by a massive global ransomware attack, but the spread of the WannaCry worm in the country appeared less aggressive than initially feared. &nbsp;(<a href="http://http://www.wionews.com/science-tech/wannacry-what-is-ransomware-and-how-to-protect-yourself-from-it-15608">Also Read: WannaCry: What is ransomware and how to protect yourself from it</a>)

Dozens of local Chinese authorities said they had suspended some of their services due to the attack that has disrupted operations at car factories, hospitals, shops and schools around the world.

However, officials and security firms said the spread was starting to slow in the country, which has the world&#39;s largest number of Internet users.

&quot;The growth rate of infected institutions on Monday has slowed significantly compared to the previous two days,&quot; said Chinese Internet security company Qihoo 360.

&quot;Previous concerns of a wide-scale infection of domestic institutions did not eventuate.&quot;

Qihoo has previously said the attack had infected close to 30,000 organizations by Saturday evening. Of that, over 4,000 were educational institutions.

An official from Cybersecurity Administration China (CAC) told local media on Monday that while the ransomware was still spreading and had affected industry and government computer systems, the spread was slowing.

China remained a major source of attack from infected computers, at least during the Asian day, said Michael Gazeley, managing director of Network Box, a Hong Kong-based cybersecurity firm.

At about noon (0400 GMT), nearly 47 per cent of attacks on Network Box&#39;s clients came from China. This would change, Gazeley said, as Europe and US computers are turned on, but it indicated the scale of the problem there.

Chinese government bodies from transport, social security, industry watchdogs and immigration said they had suspended services ranging from processing applications to traffic crime enforcement.

It&#39;s not clear whether the services were suspended due to attacks or for emergency patching to prevent infection. Even then, adding a patch was no simple task, experts said.

&quot;If a system supports some kind critical processes those systems typically are very hard to patch... We don&#39;t have a precedent from something of this scale (in China),&quot; said Marin Ivezic, a cybersecurity expert at PwC in Hong Kong.

Affected bodies included a social security department in the city of Changsha, the exit-entry bureau in Dalian, a housing fund in Zhuhai and an industry watchdog in Xuzhou.

The ransomware, which has locked up over 200,000 computers in more than 150 countries, has been mainly spread by e-mail, and in China has hit schools and colleges, energy giant PetroChina&#39;s &nbsp;payment systems and local government.

Security experts say most infected computers appear to be systems running out-of-date operating systems, or machines that are hard to patch without affecting crucial operations in areas like healthcare or manufacturing.

Beijing has said previously it is a victim of hacking, although the United States has accused it of cyber attacks on US government computer systems.

China is also set to implement a tougher new cyber security law from June 1, designed to strengthen critical infrastructure, even as many global tech firms and lobbies say that its cyber rules skew the playing field against foreign firms.

(Reuters)

China: Cyber attack hits government, schools, but spread slows

Chinese local authorities from traffic police to industry regulators were hobbled on Monday by a massive global ransomware attack, but the spread of the WannaCry worm in the country appeared less aggressive than initially feared. (Also Read: WannaCry: What is ransomware and how to protect yourself from it) Dozens of local Chinese authorities said they had suspended some of their services due to the attack that has disrupted operations at car factories, hospitals, shops and schools around the world. However, officials and security firms said the spread was starting to slow in the country, which has the world's largest number of Internet users. "The growth rate of infected institutions on Monday has slowed significantly compared to the previous two days," said Chinese Internet security company Qihoo 360. "Previous concerns of a wide-scale infection of domestic institutions did not eventuate." Qihoo has previously said the attack had infected close to 30,000 organizations by Saturday evening. Of that, over 4,000 were educational institutions. An official from Cybersecurity Administration China (CAC) told local media on Monday that while the ransomware was still spreading and had affected industry and government computer systems, the spread was slowing. China remained a major source of attack from infected computers, at least during the Asian day, said Michael Gazeley, managing director of Network Box, a Hong Kong-based cybersecurity firm. At about noon (0400 GMT), nearly 47 per cent of attacks on Network Box's clients came from China. This would change, Gazeley said, as Europe and US computers are turned on, but it indicated the scale of the problem there. Chinese government bodies from transport, social security, industry watchdogs and immigration said they had suspended services ranging from processing applications to traffic crime enforcement. It's not clear whether the services were suspended due to attacks or for emergency patching to prevent infection. Even then, adding a patch was no simple task, experts said. "If a system supports some kind critical processes those systems typically are very hard to patch... We don't have a precedent from something of this scale (in China)," said Marin Ivezic, a cybersecurity expert at PwC in Hong Kong. Affected bodies included a social security department in the city of Changsha, the exit-entry bureau in Dalian, a housing fund in Zhuhai and an industry watchdog in Xuzhou. The ransomware, which has locked up over 200,000 computers in more than 150 countries, has been mainly spread by e-mail, and in China has hit schools and colleges, energy giant PetroChina's payment systems and local government. Security experts say most infected computers appear to be systems running out-of-date operating systems, or machines that are hard to patch without affecting crucial operations in areas like healthcare or manufacturing. Beijing has said previously it is a victim of hacking, although the United States has accused it of cyber attacks on US government computer systems. China is also set to implement a tougher new cyber security law from June 1, designed to strengthen critical infrastructure, even as many global tech firms and lobbies say that its cyber rules skew the playing field against foreign firms. (Reuters)

The ransomware attack over the weekend was swift,&nbsp;<a href="http://www.wionews.com/world/global-cyberattack-has-hit-200000-victims-so-far-europol-15575">affecting&nbsp;200,000 computers</a> around the world in more than 150 countries. But a report by the computer security firm Symantec tells us that something we should have been expecting this attack.

According to the <a href="https://www.symantec.com/content/dam/symantec/docs/reports/istr-22-2017-en.pdf">Internet Security Threat Report</a>&nbsp;released just two months ago in April 2017, there were 1,271 ransomware attacks detected a day in 2016, a 36% rise from 2015.

<div id="highcharts-uvaciva"><script src='//cloud.highcharts.com/inject/uvaciva' defer='defer'></script></div>

Different variants of the same ransomware are grouped together as a &#39;family&#39;, and this security report says that there were more than a hundred new ransomware families discovered in 2016.

<div id="highcharts-yxepivy"><script src='//cloud.highcharts.com/inject/yxepivy' defer='defer'></script></div>

If we look at the average ransom demanded by these new families, it rose to around $1,077 in 2016. By contrast, the WannaCry ransomware which was behind the weekend attack, asks for <a href="http://www.wionews.com/world/global-cyberattack-has-hit-200000-victims-so-far-europol-15575">around $300</a>.

<div id="highcharts-yzoxoxy"><script src='//cloud.highcharts.com/inject/yzoxoxy' defer='defer'></script></div>

And there has been no country left untouched by ransomware attacks in 2016, with the United States bearing the brunt of it with 36%.

<div id="highcharts-egycopa"><script src='//cloud.highcharts.com/inject/egycopa' defer='defer'></script></div>

The ransomware threat has been growing over the years, as these charts show.

The ransomware attack over the weekend was swift, affecting 200,000 computers around the world in more than 150 countries. But a report by the computer security firm Symantec tells us that something we should have been expecting this attack. According to the Internet Security Threat Report released just two months ago in April 2017, there were 1,271 ransomware attacks detected a day in 2016, a 36% rise from 2015. Different variants of the same ransomware are grouped together as a 'family', and this security report says that there were more than a hundred new ransomware families discovered in 2016. If we look at the average ransom demanded by these new families, it rose to around $1,077 in 2016. By contrast, the WannaCry ransomware which was behind the weekend attack, asks for around $300. And there has been no country left untouched by ransomware attacks in 2016, with the United States bearing the brunt of it with 36%.

Infographic: How big a problem is ransomware?

A software that demands a ransom was the weapon of choice used in a wave of unprecedented global cyber attacks that affected more than 2,00,000 computers around the world over the weekend. &nbsp;

The attacks have raised questions about how this so-called ransomware works, and how to guard against it.

What is ransomware?

Ransomware is malicious software which locks computer files and forces users to pay the attackers a designated sum in the virtual Bitcoin currency to regain access to the files.

Ransomware is used on PCs as well as tablets and smartphones. It can affect &quot;at the same time individuals, businesses and institutions,&quot; Amar Zendik, CEO security firm Mind Technologies, told AFP.

How does it work?

Cyber pirates generally take control of computers by exploiting flaws in the internet. That could happen when a user logs onto a website that has been previously infected or opens an email that invites the user to click on a link or download an attachment.

In a few seconds, the malware can be implanted. And when it&#39;s installed, &quot;it can&#39;t be detected,&quot; Laurent Marechal, a cyber security expert at McAfee, told AFP.

It&#39;s only afterwards that it &quot;downloads the &#39;payload&#39;, that is the viral charge,&quot; he said.

From then on the computer work station is blocked. &quot;Most often the user has to send an SMS&quot; - and pay up - &quot;in order to get the unblocking code,&quot; &nbsp;says Marechal, adding that in certain complex cases, the virus can spread &quot;without any human intervention&quot;.

Is it used frequently?

Yes. And ransomware continues to multiply. According to security software Kapersky Lab, 62 new types of ransomware were identified last year.

And the US computer security software company McAfee said the number of &quot;samples&quot; detected increased by 88 percent in 2016, totalling some four million.

&quot;Often the pirates ask for small sums of money. But accumulated, these small amounts add up to big money,&quot; says cyber security expert Zendik.

Another expert Marechal said could be found on the &#39;dark web&#39;, an obscured part of the internet that&#39;s not indexed by classic search engines.

&quot;Individuals can buy ransomware ready to use, sometimes only for $150,&quot; he said.

Why was Friday&#39;s attack so massive?

The culprits behind the cyber attacks apparently took advantage of a flaw in the Windows operating system, which had been divulged in documents leaked from the US National Security Agency (NSA), according to initial findings of the investigation.

Zendik said the attack was based on a previously unknown Windows flaw.

&quot;We&#39;re not talking about classic &#39;ransomware&#39; which generally targets individuals and small businesses,&quot; he said. &quot;Here the hackers attacked big institutions, not likely to be susceptible to paying, especially given the publicity about the operation.&quot;

He added that &quot;in theory, the authors of the attack did not want to make money, but rather to achieve a (cyber) coup.&quot;

How can you protect against ransomware?

There are several simple rules that can be followed to reduce the risks of a ransomware attack.

Among them are regularly updating the computer&#39;s security software which can correct any flaws exploited by the virus. 
In case of a cyber attack, the authorities advise disconnecting the infected equipment immediately from the network, in order to isolate them.

In the case of a virus affecting a business or an institution, the IT experts should be alerted right away.

Authorities also recommend not paying the hackers the ransom demanded - because it&#39;s no guarantee that access to the data will be restored.

(AFP)

The recent WannaCry ransomware attack has raised questions about how it works and how to guard against it

A software that demands a ransom was the weapon of choice used in a wave of unprecedented global cyber attacks that affected more than 2,00,000 computers around the world over the weekend. The attacks have raised questions about how this so-called ransomware works, and how to guard against it. What is ransomware? Ransomware is malicious software which locks computer files and forces users to pay the attackers a designated sum in the virtual Bitcoin currency to regain access to the files. Ransomware is used on PCs as well as tablets and smartphones. It can affect "at the same time individuals, businesses and institutions," Amar Zendik, CEO security firm Mind Technologies, told AFP. How does it work? Cyber pirates generally take control of computers by exploiting flaws in the internet. That could happen when a user logs onto a website that has been previously infected or opens an email that invites the user to click on a link or download an attachment. In a few seconds, the malware can be implanted. And when it's installed, "it can't be detected," Laurent Marechal, a cyber security expert at McAfee, told AFP. It's only afterwards that it "downloads the 'payload', that is the viral charge," he said. From then on the computer work station is blocked. "Most often the user has to send an SMS" - and pay up - "in order to get the unblocking code," says Marechal, adding that in certain complex cases, the virus can spread "without any human intervention". Is it used frequently? Yes. And ransomware continues to multiply. According to security software Kapersky Lab, 62 new types of ransomware were identified last year. And the US computer security software company McAfee said the number of "samples" detected increased by 88 percent in 2016, totalling some four million. "Often the pirates ask for small sums of money. But accumulated, these small amounts add up to big money," says cyber security expert Zendik. Another expert Marechal said could be found on the 'dark web', an obscured part of the internet that's not indexed by classic search engines. "Individuals can buy ransomware ready to use, sometimes only for $150," he said. Why was Friday's attack so massive? The culprits behind the cyber attacks apparently took advantage of a flaw in the Windows operating system, which had been divulged in documents leaked from the US National Security Agency (NSA), according to initial findings of the investigation. Zendik said the attack was based on a previously unknown Windows flaw. "We're not talking about classic 'ransomware' which generally targets individuals and small businesses," he said. "Here the hackers attacked big institutions, not likely to be susceptible to paying, especially given the publicity about the operation." He added that "in theory, the authors of the attack did not want to make money, but rather to achieve a (cyber) coup." How can you protect against ransomware? There are several simple rules that can be followed to reduce the risks of a ransomware attack. Among them are regularly updating the computer's security software which can correct any flaws exploited by the virus. In case of a cyber attack, the authorities advise disconnecting the infected equipment immediately from the network, in order to isolate them. In the case of a virus affecting a business or an institution, the IT experts should be alerted right away. Authorities also recommend not paying the hackers the ransom demanded - because it's no guarantee that access to the data will be restored. (AFP)

WannaCry: What is ransomware and how to protect yourself from it

Microsoft warned governments against storing computer vulnerabilities like the leaked one at the heart of the cyberattack that has crippled computers in more than 150 countries.

&quot;The governments of the world should treat this attack as a wake up call,&quot; Microsoft&#39;s president and chief legal officer, Brad Smith, wrote in a blog post about what is being called the largest ransomware attack ever.

He warned of the danger of exploits developed by governments - this time the NSA in America - falling into the hands of hackers and causing widespread damage as is the case with the current&nbsp;attack which has crippled more than 200,000 computers around the world.

&quot;An equivalent scenario with conventional weapons would be the US military having some of its Tomahawk missiles stolen,&quot; Smith wrote.

Computers around the globe were hacked beginning on Friday using a security flaw in Microsoft&#39;s Windows XP operating system, an older version that was no longer given mainstream tech support by the US giant.

The virus spread quickly because the culprits used a digital code believed to have been developed by the US National Security Agency - and subsequently leaked as part of a document dump, according to the Moscow-based computer security firm Kaspersky Lab.

Smith argued that in cyberspace, governments should apply rules like those regarding weapons in the physical world. 
He noted that Microsoft is calling for a &quot;Digital Geneva Convention&quot; that would require governments to report computer vulnerabilities to vendors rather than store, sell or exploit them.

&quot;We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits,&quot; Smith wrote.

(AFP)

Computers around the globe were hacked beginning Friday using a security flaw in Microsoft's Windows XP operating system

Microsoft warned governments against storing computer vulnerabilities like the leaked one at the heart of the cyberattack that has crippled computers in more than 150 countries. "The governments of the world should treat this attack as a wake up call," Microsoft's president and chief legal officer, Brad Smith, wrote in a blog post about what is being called the largest ransomware attack ever. He warned of the danger of exploits developed by governments - this time the NSA in America - falling into the hands of hackers and causing widespread damage as is the case with the current attack which has crippled more than 200,000 computers around the world. "An equivalent scenario with conventional weapons would be the US military having some of its Tomahawk missiles stolen," Smith wrote. Computers around the globe were hacked beginning on Friday using a security flaw in Microsoft's Windows XP operating system, an older version that was no longer given mainstream tech support by the US giant. The virus spread quickly because the culprits used a digital code believed to have been developed by the US National Security Agency - and subsequently leaked as part of a document dump, according to the Moscow-based computer security firm Kaspersky Lab. Smith argued that in cyberspace, governments should apply rules like those regarding weapons in the physical world. He noted that Microsoft is calling for a "Digital Geneva Convention" that would require governments to report computer vulnerabilities to vendors rather than store, sell or exploit them. "We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits," Smith wrote. (AFP)

Cyberattack should be wake up call for governments: Microsoft

Three days after &#39;ransomware&#39; hit computers across the world, several computers in West Bengal&#39;s power distribution company offices were attacked by&nbsp;&#39;ransomware&#39;.

Officials from West Bengal State Electricity Distribution Company (WBSEDCL) confirmed the development and said it has been detected at four offices in West Midnapore district affecting computers in four blocks of Belda, Datan, Narayngarh and Keshiyari.

Federal minister Ravi Shankar Prasad told reporters that there was no serious impact on India, with only isolated incidents in parts of Kerala and Andhra Pradesh states, and the government was monitoring the situation.

However, West Bengal power minister Sovandev Chattopadhyay told Reuters that several billing centres of the state&#39;s Electricity Distribution Company Ltd (WBSEDCL) had been infected by the ransomware worm.

<a href="http://www.wionews.com/science-tech/wannacry-what-is-ransomware-and-how-to-protect-yourself-from-it-15608">Also Read:&nbsp;WannaCry: What is ransomware and how to protect yourself from it</a>

The &#39;WannaCry&#39; ransomware is also suspected to have struck Kerala&#39;s Wayanad panchayat office. The authorities claim that the files could not be opened and there is a message demanding $300 dollars be put in the account within three days.

Aruna Sundararajan, secretary of India&#39;s Ministry of Electronics and Information Technology, told Reuters the government was constantly monitoring the situation and that a few stand-alone computers of a police department were &quot;back in action&quot; after being infected over the weekend.

India&#39;s National Informatics Centre, which builds and manages almost all government websites, and the Centre for Development of Advanced Computing, a premier research institute that has built supercomputers, have actively installed patches to immunise their Windows systems, Sundararajan added.

India&#39;s cyber security agency have alerted Internet users against damaging activities of &#39;WannaCry&#39; which critically infects workstations and locks them through remote access. A hacker sitting in a different country can easily operate on a string of computers, infecting it and easily disabling it.

In India, &#39;ransomware&#39; is made worse because many computers might still be on Windows XP, for which Microsoft had not issued security updates for some time. However, after the cyber attack, Microsoft issued a security patch to Windows XP to fix the security vulnerability as computers worldwide were affected by the virus.

Meanwhile, in Gujarat, the state government is now upgrading its computer systems with anti-virus software and updating the Microsoft OS as well.

The ransomware virus had struck Britain&#39;s national health service(NHS) on Friday evening shutting down computer services in at at least 16 hospitals initially, severely disrupting emergency services which had to be suspended.&nbsp;

<a href="http://www.wionews.com/science-tech/infographic-how-big-a-problem-is-ransomware-15613">Also Read:&nbsp;Infographic: How big a problem is </a><a href="http://www.wionews.com/science-tech/infographic-how-big-a-problem-is-ransomware-15613">ransomware</a><a href="http://www.wionews.com/science-tech/infographic-how-big-a-problem-is-ransomware-15613">?</a>

(WION with Agency&nbsp;inputs)

India's cyber security agency have alerted Internet users against damaging activities of 'WannaCry'

Three days after 'ransomware' hit computers across the world, several computers in West Bengal's power distribution company offices were attacked by 'ransomware'. Officials from West Bengal State Electricity Distribution Company (WBSEDCL) confirmed the development and said it has been detected at four offices in West Midnapore district affecting computers in four blocks of Belda, Datan, Narayngarh and Keshiyari. Federal minister Ravi Shankar Prasad told reporters that there was no serious impact on India, with only isolated incidents in parts of Kerala and Andhra Pradesh states, and the government was monitoring the situation. However, West Bengal power minister Sovandev Chattopadhyay told Reuters that several billing centres of the state's Electricity Distribution Company Ltd (WBSEDCL) had been infected by the ransomware worm. Also Read: WannaCry: What is ransomware and how to protect yourself from it The 'WannaCry' ransomware is also suspected to have struck Kerala's Wayanad panchayat office. The authorities claim that the files could not be opened and there is a message demanding $300 dollars be put in the account within three days. Aruna Sundararajan, secretary of India's Ministry of Electronics and Information Technology, told Reuters the government was constantly monitoring the situation and that a few stand-alone computers of a police department were "back in action" after being infected over the weekend. India's National Informatics Centre, which builds and manages almost all government websites, and the Centre for Development of Advanced Computing, a premier research institute that has built supercomputers, have actively installed patches to immunise their Windows systems, Sundararajan added. India's cyber security agency have alerted Internet users against damaging activities of 'WannaCry' which critically infects workstations and locks them through remote access. A hacker sitting in a different country can easily operate on a string of computers, infecting it and easily disabling it. In India, 'ransomware' is made worse because many computers might still be on Windows XP, for which Microsoft had not issued security updates for some time. However, after the cyber attack, Microsoft issued a security patch to Windows XP to fix the security vulnerability as computers worldwide were affected by the virus. Meanwhile, in Gujarat, the state government is now upgrading its computer systems with anti-virus software and updating the Microsoft OS as well. The ransomware virus had struck Britain's national health service(NHS) on Friday evening shutting down computer services in at at least 16 hospitals initially, severely disrupting emergency services which had to be suspended. Also Read: Infographic: How big a problem is ransomware? (WION with Agency inputs)

'Ransomware' hits West Bengal state electricity company, Kerala panchayat office

A cybersecurity researcher appears to have discovered a &quot;kill switch&quot; that can prevent the spread of the WannaCry ransomware -- for now -- that has caused the cyberattacks wreaking havoc globally, they told AFP Saturday.

The researcher, tweeting as @MalwareTechBlog, said the discovery was accidental, but that registering a domain name used by the malware stops it from spreading.

&quot;Essentially they relied on a domain not being registered and by registering it, we stopped their malware spreading,&quot; @MalwareTechBlog told AFP in a private message on Twitter.

The researcher warned however that people &quot;need to update their systems ASAP&quot; to avoid attack.

&quot;The crisis isn&#39;t over, they can always change the code and try again,&quot; @MalwareTechBlog said.

Friday&#39;s wave of cyberattacks, which affected dozens of countries, apparently exploited a flaw exposed in documents leaked from the US National Security Agency.

The attacks used a technique known as ransomware that locks users&#39; files unless they pay the attackers a designated sum in the virtual currency Bitcoin.

Affected by the onslaught were computer networks at hospitals in Britain, Russia&#39;s interior ministry, the Spanish telecom giant Telefonica and the US delivery firm FedEx and many other organisations.

&quot;I will confess that I was unaware registering the domain would stop the malware until after I registered it, so initially it was accidental,&quot; @MalwareTechBlog tweeted.

Unfortunately however, computers already affected will not be helped by the solution.

&quot;So long as the domain isn&#39;t revoked, this particular strain will no longer cause harm, but patch your systems ASAP as they will try again.&quot;

The malware&#39;s name is WCry, but analysts were also using variants such as WannaCry.

Forcepoint Security Labs said in a Friday statement that the attack had &quot;global scope&quot; and was affecting networks in Australia, Belgium, France, Germany, Italy and Mexico.

In the United States, FedEx acknowledged it had been hit by malware and was &quot;implementing remediation steps as quickly as possible.&quot;

Also badly hit was Britain&#39;s National Health Service, which declared a &quot;major incident&quot; after the attack, which forced some hospitals to divert ambulances and scrap operations.

Pictures posted on social media showed screens of NHS computers with images demanding payment of $300 (275 euros) in Bitcoin, saying: &quot;Ooops, your files have been encrypted!&quot;

It demands payment in three days or the price is doubled, and if none is received in seven days, the files will be deleted, according to the screen message.

A hacking group called Shadow Brokers released the malware in April claiming to have discovered the flaw from the NSA, according to Kaspersky Lab, a Russian cybersecurity provider.

Kaspersky researcher Costin Raiu cited 45,000 attacks in 74 countries as of Friday evening.

(AFP)

The researcher warned people 'need to update their systems ASAP' to avoid attack

A cybersecurity researcher appears to have discovered a "kill switch" that can prevent the spread of the WannaCry ransomware -- for now -- that has caused the cyberattacks wreaking havoc globally, they told AFP Saturday. The researcher, tweeting as @MalwareTechBlog, said the discovery was accidental, but that registering a domain name used by the malware stops it from spreading. "Essentially they relied on a domain not being registered and by registering it, we stopped their malware spreading," @MalwareTechBlog told AFP in a private message on Twitter. The researcher warned however that people "need to update their systems ASAP" to avoid attack. "The crisis isn't over, they can always change the code and try again," @MalwareTechBlog said. Friday's wave of cyberattacks, which affected dozens of countries, apparently exploited a flaw exposed in documents leaked from the US National Security Agency. The attacks used a technique known as ransomware that locks users' files unless they pay the attackers a designated sum in the virtual currency Bitcoin. Affected by the onslaught were computer networks at hospitals in Britain, Russia's interior ministry, the Spanish telecom giant Telefonica and the US delivery firm FedEx and many other organisations. "I will confess that I was unaware registering the domain would stop the malware until after I registered it, so initially it was accidental," @MalwareTechBlog tweeted. Unfortunately however, computers already affected will not be helped by the solution. "So long as the domain isn't revoked, this particular strain will no longer cause harm, but patch your systems ASAP as they will try again." The malware's name is WCry, but analysts were also using variants such as WannaCry. Forcepoint Security Labs said in a Friday statement that the attack had "global scope" and was affecting networks in Australia, Belgium, France, Germany, Italy and Mexico. In the United States, FedEx acknowledged it had been hit by malware and was "implementing remediation steps as quickly as possible." Also badly hit was Britain's National Health Service, which declared a "major incident" after the attack, which forced some hospitals to divert ambulances and scrap operations. Pictures posted on social media showed screens of NHS computers with images demanding payment of $300 (275 euros) in Bitcoin, saying: "Ooops, your files have been encrypted!" It demands payment in three days or the price is doubled, and if none is received in seven days, the files will be deleted, according to the screen message. A hacking group called Shadow Brokers released the malware in April claiming to have discovered the flaw from the NSA, according to Kaspersky Lab, a Russian cybersecurity provider. Kaspersky researcher Costin Raiu cited 45,000 attacks in 74 countries as of Friday evening. (AFP)

Researcher finds 'kill switch' to cyberattack wreaking havoc worldwide

Finance chiefs from the Group of Seven rich countries will commit on Saturday to join forces to fight the growing threat of international cyber attacks, according to a draft statement of a meeting they are holding in Italy.

A global cyber attack infected tens of thousands of computers in nearly 100 countries on Friday.

&quot;We recognise that cyber incidents represent a growing threat for our economies and that appropriate economy-wide policy responses are needed,&quot; the draft statement, seen by Reuters, said.

It called for common shared practices to spot quickly any vulnerabilities in the world&#39;s financial system and stressed the importance of effective measures to assess cyber security among individual financial firms and at sector level.

The draft will be reviewed before publication later on Saturday by the G7 finance ministers and central bankers who are discussing issues facing the world economy at a two-day meeting in Bari, Italy.

Italian finance minister Pier Carlo Padoan told reporters that the discussions, which had been scheduled before Friday&#39;s attacks, were &quot;unfortunately very timely.&quot;&nbsp;

(Reuters)

Finance chiefs of the Group of Seven rich countries are meeting in Italy

Finance chiefs from the Group of Seven rich countries will commit on Saturday to join forces to fight the growing threat of international cyber attacks, according to a draft statement of a meeting they are holding in Italy. A global cyber attack infected tens of thousands of computers in nearly 100 countries on Friday. "We recognise that cyber incidents represent a growing threat for our economies and that appropriate economy-wide policy responses are needed," the draft statement, seen by Reuters, said. It called for common shared practices to spot quickly any vulnerabilities in the world's financial system and stressed the importance of effective measures to assess cyber security among individual financial firms and at sector level. The draft will be reviewed before publication later on Saturday by the G7 finance ministers and central bankers who are discussing issues facing the world economy at a two-day meeting in Bari, Italy. Italian finance minister Pier Carlo Padoan told reporters that the discussions, which had been scheduled before Friday's attacks, were "unfortunately very timely." (Reuters)

G7 nations to agree joint fight against cyber attacks: Draft

A fast-moving wave of cyberattacks swept the globe Friday, apparently exploiting a flaw exposed in documents leaked from the US National Security Agency.

The attacks -- which experts said affected dozens of countries -- used a technique known as ransomware that locks users&#39; files unless they pay the attackers a designated sum in the virtual currency Bitcoin.

Affected by the onslaught were computer networks at hospitals in Britain, Russia&#39;s interior ministry, the Spanish telecom giant Telefonica and the US delivery firm FedEx and many other organizations.

Britain&#39;s National Cyber Security Centre and its National Crime Agency were looking into the UK incidents, which disrupted care at National Health Service facilities.

&quot;This is not targeted at the NHS, it&#39;s an international attack and a number of countries and organizations have been affected,&quot; British Prime Minister Theresa May said.

Russia&#39;s interior ministry said that some of its computers had been hit by a &quot;virus attack&quot; and that efforts were underway to destroy it.

The US Department of Homeland Security&#39;s computer emergency response team said it was aware of ransomware infections &quot;in several countries around the world.&quot;

Jakub Kroustek of the security firm Avast said in a blog post update around 2000 GMT, &nbsp;&quot;We are now seeing more than 75,000 detections... in 99 countries.&quot;

Kaspersky researcher Costin Raiu cited 45,000 attacks in 74 countries, saying that the malware, a self-replicating &quot;worm,&quot; was spreading quickly.

In a statement, Kaspersky Labs said it was &quot;trying to determine whether it is possible to decrypt data locked in the attack -- with the aim of developing a decryption tool as soon as possible.&quot;

&#39;Unequivocally scary&#39; 
&quot;It&#39;s unequivocally scary,&quot; said John Dickson of the Denim Group, a US security consultancy.

Dickson said the malware itself, which exploits a flaw in Windows, was not new but that adding the ransomware &quot;payload&quot; made it especially dangerous.

&quot;I&#39;m watching how far this propagates and when governments get involved,&quot; he said.

The malware&#39;s name is WCry, but analysts were also using variants such as WannaCry.

Forcepoint Security Labs said in a statement that the attack had &quot;global scope&quot; and was affecting networks in Australia, Belgium, France, Germany, Italy and Mexico.

In the United States, FedEx acknowledged it had been hit by malware and was &quot;implementing remediation steps as quickly as possible.&quot;

Britain&#39;s National Health Service declared a &quot;major incident&quot; after the attack, which forced some hospitals to divert ambulances and scrap operations.

Message to users: &#39;Oops&#39; 
Pictures posted on social media showed screens of NHS computers with images demanding payment of $300 (275 euros) in Bitcoin, saying: &quot;Ooops, your files have been encrypted!&quot;

It demands payment in three days or the price is doubled, and if none is received in seven days, the files will be deleted, according to the screen message.

A hacking group called Shadow Brokers released the malware in April claiming to have discovered the flaw from the NSA, Kaspersky said.

Although Microsoft released a security patch for the flaw earlier this year, many systems have yet to be updated, researchers said.

&quot;Unlike most other attacks, this malware is spreading primarily by direct infection from machine to machine on local networks, rather than purely by email,&quot; Lance Cottrell, chief scientist at the US technology group Ntrepid.&nbsp;

&quot;The ransomware can spread without anyone opening an email or clicking on a link.&quot;

The sort of ransom demands have been growing precedent at medical facilities. In February 2016, a Los Angeles hospital, the Hollywood Presbyterian Medical Center, paid $17,000 in Bitcoin to hackers who took control of its computers for more than a week.

&quot;Ransomware becomes particularly nasty when it infects institutions like hospitals, where it can put people&#39;s lives in danger,&quot; said Kroustek, the Avast analyst.

A spokesman for Barts Health NHS Trust in London said it was experiencing &quot;major IT disruption&quot; and delays at all four of its hospitals.

&quot;We have activated our major incident plan to make sure we can maintain the safety and welfare of patients,&quot; the spokesman said. &quot;Ambulances are being diverted to neighboring hospitals.&quot;

Two employees at St Bartholomew&#39;s Hospital, which is part of Barts Health, told AFP that all the computers in the hospital had been turned off.

Caroline Brennan, 41, went to the hospital to see her brother, who had open heart surgery.

&quot;They told us there was a problem. They said the system was down and that they cannot transfer anyone till the computer system was back up,&quot; Brennan said.

Some said the attacks highlighted the need for agencies like the NSA to disclose security flaws so they can be patched.

&quot;These attacks underscore the fact that vulnerabilities will be exploited not just by our security agencies, but by hackers and criminals around the world,&quot; said Patrick Toomey of the American Civil Liberties Union.

(AFP) 
&nbsp;

The ransomware locked users' files unless they paid up, in Bitcoin.

A fast-moving wave of cyberattacks swept the globe Friday, apparently exploiting a flaw exposed in documents leaked from the US National Security Agency. The attacks -- which experts said affected dozens of countries -- used a technique known as ransomware that locks users' files unless they pay the attackers a designated sum in the virtual currency Bitcoin. Affected by the onslaught were computer networks at hospitals in Britain, Russia's interior ministry, the Spanish telecom giant Telefonica and the US delivery firm FedEx and many other organizations. Britain's National Cyber Security Centre and its National Crime Agency were looking into the UK incidents, which disrupted care at National Health Service facilities. "This is not targeted at the NHS, it's an international attack and a number of countries and organizations have been affected," British Prime Minister Theresa May said. Russia's interior ministry said that some of its computers had been hit by a "virus attack" and that efforts were underway to destroy it. The US Department of Homeland Security's computer emergency response team said it was aware of ransomware infections "in several countries around the world." Jakub Kroustek of the security firm Avast said in a blog post update around 2000 GMT, "We are now seeing more than 75,000 detections... in 99 countries." Kaspersky researcher Costin Raiu cited 45,000 attacks in 74 countries, saying that the malware, a self-replicating "worm," was spreading quickly. In a statement, Kaspersky Labs said it was "trying to determine whether it is possible to decrypt data locked in the attack -- with the aim of developing a decryption tool as soon as possible." 'Unequivocally scary' "It's unequivocally scary," said John Dickson of the Denim Group, a US security consultancy. Dickson said the malware itself, which exploits a flaw in Windows, was not new but that adding the ransomware "payload" made it especially dangerous. "I'm watching how far this propagates and when governments get involved," he said. The malware's name is WCry, but analysts were also using variants such as WannaCry. Forcepoint Security Labs said in a statement that the attack had "global scope" and was affecting networks in Australia, Belgium, France, Germany, Italy and Mexico. In the United States, FedEx acknowledged it had been hit by malware and was "implementing remediation steps as quickly as possible." Britain's National Health Service declared a "major incident" after the attack, which forced some hospitals to divert ambulances and scrap operations. Message to users: 'Oops' Pictures posted on social media showed screens of NHS computers with images demanding payment of $300 (275 euros) in Bitcoin, saying: "Ooops, your files have been encrypted!" It demands payment in three days or the price is doubled, and if none is received in seven days, the files will be deleted, according to the screen message. A hacking group called Shadow Brokers released the malware in April claiming to have discovered the flaw from the NSA, Kaspersky said. Although Microsoft released a security patch for the flaw earlier this year, many systems have yet to be updated, researchers said. "Unlike most other attacks, this malware is spreading primarily by direct infection from machine to machine on local networks, rather than purely by email," Lance Cottrell, chief scientist at the US technology group Ntrepid. "The ransomware can spread without anyone opening an email or clicking on a link." The sort of ransom demands have been growing precedent at medical facilities. In February 2016, a Los Angeles hospital, the Hollywood Presbyterian Medical Center, paid $17,000 in Bitcoin to hackers who took control of its computers for more than a week. "Ransomware becomes particularly nasty when it infects institutions like hospitals, where it can put people's lives in danger," said Kroustek, the Avast analyst. A spokesman for Barts Health NHS Trust in London said it was experiencing "major IT disruption" and delays at all four of its hospitals. "We have activated our major incident plan to make sure we can maintain the safety and welfare of patients," the spokesman said. "Ambulances are being diverted to neighboring hospitals." Two employees at St Bartholomew's Hospital, which is part of Barts Health, told AFP that all the computers in the hospital had been turned off. Caroline Brennan, 41, went to the hospital to see her brother, who had open heart surgery. "They told us there was a problem. They said the system was down and that they cannot transfer anyone till the computer system was back up," Brennan said. Some said the attacks highlighted the need for agencies like the NSA to disclose security flaws so they can be patched. "These attacks underscore the fact that vulnerabilities will be exploited not just by our security agencies, but by hackers and criminals around the world," said Patrick Toomey of the American Civil Liberties Union. (AFP)

Fast-moving cyberattacks wreak havoc worldwide

ransomware

Ransomware, News on Ransomware, stories on Ransomware, articles on Ransomware, Ransomware stories at Wion, Ransomware news, Ransomware latest news