Governments and companies around the world began to gain the upper hand against the first wave of an unrivaled global cyberattack, even as the assault was poised to continue claiming victims this week.
More than 200 000 computers in at least 150 countries have so far been infected, according to Europol, the European Union’s law enforcement agency. The UK’s National Cyber Security Centre said new cases of so-called ransomware are possible “at a significant scale”.
“For now, it does not look like the number of infected computers is increasing,” said a Europol spokesman. “We will get a decryption tool eventually, but for the moment, it’s still a live threat and we’re still in disaster recovery mode.”
At Germany’s national Deutsche Bahn railroad, workers were labouring under “high pressure” on Monday to repair remaining glitches with train stations’ electronic departure boards, a spokesman said.
French car maker Renault, which halted production at some factories to stop the virus from spreading, said 90% of factories worldwide had now resumed operations, according to a spokesman on Monday.
A new version of the ransomware may have also been spreading over the weekend. Matt Suiche, founder of United Arab Emirates-based cybersecurity firm Comae Technologies, said around 10 000 machines have been infected by the second variation of the malware.
The malware used a technique purportedly stolen from the US National Security Agency. It affected the UK’s National Health Service, Russia’s ministry of interior, China government agencies, Deutsche Bahn, car makers Nissan and Renault, PetroChina, logistics giant FedEx, and other company and hospital computer systems in countries from Eastern Europe to the US and Asia.
The hackers used the tool to encrypt files within affected computers, making them inaccessible, and demanded ransom — typically US$300 in bitcoin. Russia and Ukraine had a heavy concentration of infections, according to Dutch security company Avast Software.
Microsoft president Brad Smith, in a blog post on Sunday, said the attack is a “wake-up call” for governments in the US and elsewhere to stop stockpiling tools to exploit digital vulnerabilities. “They need to take a different approach and adhere in cyberspace to the same rules applied to weapons in the physical world,” he said.
The initial attack was stifled when a security researcher disabled a key mechanism used by the worm to spread, but experts said the hackers were likely to mount a second attack because so many users of PCs with Microsoft operating systems couldn’t or didn’t download a security patch released in March that Microsoft had labeled “critical”.
Microsoft said in a blog post on Saturday that it was taking the “highly unusual“ step of providing the patch for older versions of Windows it was otherwise no longer supporting, including Windows XP and Windows Server 2003.
While the scale of the attack shows Microsoft needs to strengthen its own capabilities, “there is simply no way for customers to protect themselves against threats unless they update their system”, Smith said in his blog post. “Otherwise they’re literally fighting the problems of the present with tools from the past.
“This attack is a powerful reminder that information technology basics like keeping computers current and patched are a high responsibility for everyone, and it’s something every top executive should support.”
Victims have paid about $50 000 in ransom so far, with the total expected to rise, said Tom Robinson, chief operating officer and co-founder of Elliptic Enterprises, a ransomware consultant that works with banks and companies in the UK, the US and Europe. Robinson, in an interview by e-mail, said he calculated the total based on payments tracked to bitcoin addresses specified in the ransom demands.
Last year an acute-care hospital in Hollywood paid $17 000 in bitcoin to an extortionist who hijacked its computer systems and forced doctors and staff to revert to pen and paper for record-keeping.
Ransomware is a particularly stubborn problem because victims are often tricked into allowing the malicious software to run on their computers, and the encryption happens too fast for security software to catch it. Some security experts calculate that ransomware may bring in as much as $1bn/year in revenue for the attackers.
The attack was apparently halted in the afternoon in the UK when a researcher took control of an Internet domain that acted as a kill switch for the worm’s propagation, according to Ars Technica.
“I will confess that I was unaware registering the domain would stop the malware until after I registered it, so initially it was accidental,” wrote the researcher, who uses the Twitter name @MalwareTechBlog. “So long as the domain isn’t revoked, this particular strain will no longer cause harm, but patch your systems ASAP as they will try again.”
A second variant of the domain also became apparent. Suiche, founder of Comae Technologies, said on Sunday he registered another kill-switch for a different version of the ransomware. About 50% of machines that would have spread the infection by the second variation of the malware have Russian IP addresses, according to Suiche.
There is a high probability that Russian-language cybercriminals were behind the attack, said Aleks Gostev, chief cybersecurity expert for Kaspersky Labs.
“Ransomware is traditionally their topic,” he said. “The geography of attacks that hit post-Soviet Union most also suggests that.” — (c) 2017 Bloomberg LP