Ransomware virus plagues 100k computers across 99 countries
A ransomware virus is spreading aggressively around the globe, with over 100,000 computers in 99 countries having been targeted, according to the latest data. The virus infects computer files and then demands bitcoins to unblock them.
LIVE UPDATES: Mass cyberattack strikes computer systems worldwide
An increase in activity of the malware was noticed starting from 8am CET (07:00 GMT) Friday, security software company Avast reported, adding that it "quickly escalated into a massive spreading."
In a matter of hours, over 75,000 attacks have been detected worldwide, the company said. Meanwhile, the MalwareTech tracker detected over 100,000 infected systems over the past 24 hours.
#wcry#WannaCry#WannaCrypt0r#ransomware hitting 100k Avast detections in less than 24 hours. 57% in Russia. Patch your systems!
— Jakub Kroustek (@JakubKroustek) 13 мая 2017 г.
Dozens of countries around the globe have been affected, with the number of victims still growing, according to the Russian multinational cybersecurity and anti-virus provider, the Kaspersky Lab.
So far, we have recorded more than 45,000 attacks of the #WannaCry ransomware in 74 countries around the world. Number still growing fast.
— Costin Raiu (@craiu) May 12, 2017
The ransomware, known as WanaCrypt0r 2.0, or WannaCry, is believed to have infected National Health Service (NHS) hospitals in the UK and Spain's biggest national telecommunications firm, Telefonica.
READ MORE: Hospital computers across Britain shut down by cyberattack, hackers demanding ransom
Britain and Spain are among the first nations who have officially recognized the attack. In Spain, apart from the telecommunications giant, Telefonica, a large number of other companies has been infected with the malicious software, Reuters reported.
The virus is said to attack computers on an internal network, as is the case with Telefonica, without affecting clients.
‘Militarization of cyberspace going out of control’: IT experts talk WannaCry ransomware hackstorm (Op-Edge) https://t.co/6FLFxJh8EW
— RT (@RT_com) 13 мая 2017 г.
Computers at Russia's Interior Ministry have been infected with the malware, the ministry said Friday evening.
Some 1,000 Windows-operated PCs were affected, which is less than one percent of the total number of such computers in the ministry, spokeswoman Irina Volk said in a statement. The virus has been localized and steps are being taken to eliminate it.
The servers of the ministry have not been affected, Volk added, saying it’s operated by different systems for Russia-developed data processing machines.
"Several" computers of Russia's Emergency Ministry had also been targeted, its representative told TASS, adding, that "all of the attempted attacks had been blocked, and none of the computers were infected with the virus."
Russian telecom giant, Megafon has also been affected.
"The very virus that is spreading worldwide and demanding $300 to be dealt with has been found on a large number of our computers in the second half of the day today," Megafon's spokesperson Pyotr Lidov told RT.
The internal network had been affected, he said, adding that in terms of the company's customer services, the work of the support team had been temporarily hindered, "as operators use computers" to provide their services.
The company immediately took appropriate measures, the spokesperson said, adding that the incident didn't affect subscribers' devices or Megafon signal capabilities in any way.
British Prime Minister Theresa May has said the cyberattack on UK hospitals is part of a wider international attack.
In Sweden, the mayor of Timra said "around 70 computers have had a dangerous code installed," Reuters reported.
According to Avast, the ransomware has also targeted Ukraine and Taiwan.
Did you backup today? 5 easy tips to protect yourself from ransomware, #WannaCry for example https://t.co/X09CVLB1JRpic.twitter.com/5Xj9rOGOQT
— RT (@RT_com) 13 мая 2017 г.
The virus is apparently the upgraded version of the ransomware that first appeared in February. Believed to be affecting only Windows operated computers, it changes the affected file extension names to ".WNCRY."
It then drops ransom notes to a user in a text file, demanding $300 worth of bitcoins to be paid to unlock the infected files within a certain period of time.
In light of today's attack, Congress needs to be asking @NSAgov if it knows of any other vulnerabilities in software used in our hospitals.
— Edward Snowden (@Snowden) May 12, 2017
While the victim's wallpaper is being changed, affected users also see a countdown timer to remind them of the limited time they have to pay the ransom. If they fail to pay, their data will be deleted, cybercriminals warn.
According to security experts, the ransomware exploits a vulnerability that was discovered and developed by the National Security Agency. The exploit was leaked by a group calling itself the Shadow Brokers, that has been distributing the stolen NSA hacking tools online since last year.
