Cyber attack sweeps globe, researchers see 'WannaCry' link

Cyber attack sweeps globe, researchers see 'WannaCry' link
Wed Jun 28, 2017 07:19:52

A major global cyber attack on Tuesday disrupted computers at Russia's biggest oil company, Ukrainian banks and multinational firms with a virus similar to the ransomware that last month infected more than 300,000 computers.

(reuters) -- The rapidly spreading cyber extortion campaign underscored growing concerns that businesses have failed to secure their networks from increasingly aggressive hackers, who have shown they are capable of shutting down critical infrastructure and crippling corporate and government networks.

It included code known as "Eternal Blue," which cyber security experts widely believe was stolen from the U.S. National Security Agency (NSA) and was also used in last month's ransomware attack, named "WannaCry."

"Cyber attacks can simply destroy us," said Kevin Johnson, chief executive of cyber security firm Secure Ideas. "Companies are just not doing what they are supposed to do to fix the problem."

The ransomware virus crippled computers running Microsoft Corp's (MSFT.O) Windows by encrypting hard drives and overwriting files, then demanded $300 in bitcoin payments to restore access. More than 30 victims paid into the bitcoin account associated with the attack, according to a public ledger of transactions listed on

Microsoft said the virus could spread through a flaw that was patched in a security update in March.

"We are continuing to investigate and will take appropriate action to protect customers," a spokesman for the company said, adding that Microsoft antivirus software detects and removes it.

Russia and Ukraine were most affected by the thousands of attacks, according to security software maker Kaspersky Lab, with other victims spread across countries including Britain, France, Germany, Italy, Poland and the United States. The total number of attacks was unknown.

Security experts said they expected the impact to be smaller than WannaCry since many computers had been patched with Windows updates in the wake of WannaCry last month to protect them against attacks using Eternal Blue code.

Still, the attack could be more dangerous than traditional strains of ransomware because it makes computers unresponsive and unable to reboot, Juniper Networks (JNPR.N) said in a blog post analyzing the attack.

Researchers said the attack may have borrowed malware code used in earlier ransomware campaigns known as "Petya" and "GoldenEye."

Following last month's attack, governments, security firms and industrial groups aggressively advised businesses and consumers to make sure all their computers were updated with Microsoft patches to defend against the threat.

The first attacks were reported from Russia and Ukraine.

Russia's Rosneft (ROSN.MM), one of the world's biggest crude producers by volume, said its systems had suffered "serious consequences," but added oil production had not been affected because it switched over to backup systems.

Ukrainian Deputy Prime Minister Pavlo Rozenko said the government's computer network went down and the central bank reported disruption to operations at banks and firms including the state power distributor.

Danish shipping giant A.P. Moller-Maersk (MAERSKb.CO) said it was among the victims, reporting outages at facilities including its Los Angeles terminal.

WPP (WPP.L), the world's largest advertising agency, said it was also infected. A WPP employee who asked not to be named said that workers were told to shut down their computers: "The building has come to a standstill."

A Ukrainian media company said its computers were blocked and it was asked to pay $300 in the crypto-currency bitcoin to regain access.

"Perhaps you are busy looking for a way to recover your files, but don't waste your time. Nobody can recover your files without our decryption service," the message said, according to a screenshot posted on Ukraine's Channel 24.

Russia's central bank said there were isolated cases of lenders' IT systems being infected. One consumer lender, Home Credit, had to suspend client operations.

Other companies that identified themselves as victims included French construction materials firm Saint Gobain (SGOB.PA), U.S. drugmaker Merck & Co (MRK.N) and Mars Inc's Royal Canin pet food business.

India-based employees at Beiersdorf, makers of Nivea skin care products, and Reckitt Benckiser (RB.L), which owns Enfamil and Lysol, told Reuters the ransomware attack had impacted some of their systems in the country.

Western Pennsylvania's Heritage Valley Health System's entire network was shut down by a cyber attack on Tuesday, according to local media reports.

Last's month's fast-spreading WannaCry ransomware attack was crippled after a 22-year-old British security researcher Marcus Hutchins created a so-called "kill switch" that experts hailed as the decisive step in slowing the attack.

Security experts said they did not believe that the ransomware released on Tuesday had a kill switch, meaning that it might be harder to stop.

string(545) "[{"id":"1907528","sort":"4868171","contenttypeid":"21","pic":"/2017/01/06/alalam_636192925001013913_25f_4x3.jpg","title":"US Intelligence Officials: Russian Cyber Attacks Are ‘Major Threat’"} ,{"id":"1968645","sort":"4868170","contenttypeid":"21","pic":"/2017/05/16/alalam_636305173981685216_25f_4x3.jpg","title":"US behind the global cyber attack: Putin"} ,{"id":"1968828","sort":"4868169","contenttypeid":"21","pic":"/2017/05/16/alalam_636305412358518488_25f_4x3.jpg","title":""WannaCry" ransomware attack losses could reach $4 billion"} ]"