Global ransomware attack causes turmoil

Companies across the globe are reporting that they have been struck by a major ransomware cyber-attack.

British advertising agency WPP is among those to say its IT systems have been disrupted as a consequence.

Ukrainian firms, including the state power company and Kiev’s main airport, were among the first to report issues.

The Chernobyl nuclear power plant has also had to monitor radiation levels manually after its Windows-based sensors were shut down.

The international police organisation Interpol has said it is “closely monitoring” the situation and liaising with its member countries.

Experts suggest the malware is taking advantage of the same weaknesses used by the Wannacry attack last month.

Képtalálat a következőre: „Global ransomware attack causes turmoil”

“It initially appeared to be a variant of a piece of ransomware that emerged last year,” said computer scientist Prof Alan Woodward.

“The ransomware was called Petya and the updated version Petrwrap.

“However, now that’s not so clear.”

The Russian cybersecurity firm Kaspersky Lab reported that it believed the malware was a “new ransomware that has not been seen before” despite its resemblance to Petya.

Képtalálat a következőre: „petya”

As a result, the firm has dubbed it NotPetya. Kaspersky added that it had detected suspected attacks in Poland, Italy, Germany, France and the US in addition to the UK, Russia and Ukraine.

Andrei Barysevich, a spokesman for security firm Recorded Future told the BBC such attacks would not stop because cyber-thieves found them too lucrative.

“A South Korean hosting firm just paid $1m to get their data back and that’s a huge incentive,” he said. “It’s the biggest incentive you could offer to a cyber-criminal.”

Képtalálat a következőre: „petya”

A bitcoin wallet associated with the outbreak has received several payments since the outbreak began. The wallet currently holds 1.5 bitcoins – equivalent to $3,500.

An email address associated with the blackmail attempt has been blocked by German independent email provider Posteo.

It means that the blackmailers have not been able to access the mailbox.

Képtalálat a következőre: „petya”

Network down

Others reporting problems include the Ukrainian central bank, the aircraft manufacturer Antonov, and two postal services.

Russian oil producer Rosneft and Danish shipping company Maersk also say they face disruption, including its offices in the UK and Ireland.

“We can confirm that Maersk IT systems are down across multiple sites and business units due to a cyber-attack,” the Copenhagen-headquartered firm said via Twitter.

“We continue to assess the situation. The safety of our employees, our operations and customers’ business is our top priority.”

Maerk tweekMaersk tweeted that its computer systems had been taken offline

Spanish media reports that the offices of the food giant Mondelez – whose brands include Oreo and Toblerone – had suffered attacks.

Netherlands-based shipping company TNT said some of its systems needed “remediation”.

And French construction materials company St Gobain has said that it had fallen victim.

In the US, the pharmaceuticals-maker Merck and local offices of the law firm DLA Piper have been affected.

“Please remove all laptops from docking stations and keep turned off – no exceptions,” read a sign erected in the lobby of DLA Piper’s Washington DC office.

A US hospital operator, Heritage Valley Health System, has also reported its computer network is down causing operations to be delayed, but it is not yet clear if it was subject to the same type of attack.

The attacks come two months after another global ransomware assault, known as Wannacry, which caused major problems for the UK’s National Health Service.

No defence

Veteran security expert Chris Wysopal from Veracode said the malware seemed to be spreading via some of the same Windows code loopholes exploited by Wannacry. Many firms did not patch those holes because Wannacry was tackled so quickly, he added.

NCA tweetThe UK’s National Crime Agency is investigating the threat

Those being caught out were also industrial firms that often struggled to apply software patches quickly.

“These organisations typically have a challenge patching all of their machines because so many systems cannot have down time,” he said. “Airports also have this challenge.”

Copies of the virus have been submitted to online testing systems that check if security software, particularly anti-virus systems, were able to spot and stop it.

“Only two vendors were able to detect it so many systems are defenceless if they are unpatched and relying on anti-virus,” he said.

Tweet

Ukraine seems to have been particularly badly hit this time round.

Reports suggest that the Kiev metro system has stopped accepting payment cards while several chains of petrol stations have suspended operations.

Ukraine’s deputy prime minister has tweeted a picture appearing to show government systems have been affected.

His caption reads: “Ta-daaa! Network is down at the Cabinet of Minister’s secretariat.”

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s