You are here

Cyber attack sweeps globe, researchers see 'WannaCry' link




It included code known as "Eternal Blue", which cyber security experts widely believe was stolen from the US National Security Agency and was also used in last month's ransomware attack, named "WannaCry".



The ransomware virus crippled computers running Microsoft Corp's Windows by encrypting hard drives and overwriting files, then demanded US$300 in bitcoin payments to restore access. More than 30 victims paid into the bitcoin account associated with the attack, according to a public ledger of transactions listed on



Some 2,000 attacks were observed as of midday in New York on Tuesday, according to Kaspersky Lab. Russia and Ukraine were most affected, with other victims spread across countries including Britain, France, Germany, Italy, Poland and the United States, the security software maker said.



Researchers said the attack may have borrowed malware code used in earlier ransomware campaigns known as "Petya" and "GoldenEye".




Several private security experts have said they believe Shadow Brokers is tied to the Russian government, and that the North Korean government was behind WannaCry. Both countries' governments deny charges they are involved in hacking.


The first attacks were reported from Russia and Ukraine.

Russia's Rosneft, one of the world's biggest crude producers by volume, said its systems had suffered "serious consequences," but added oil production had not been affected because it switched over to backup systems.

Ukrainian Deputy Prime Minister Pavlo Rozenko said the government's computer network went down and the central bank reported disruption to operations at banks and firms including the state power distributor.


WPP, the world's largest advertising agency, said it was also infected. A WPP employee who asked not to be named said that workers were told to shut down their computers: "The building has come to a standstill."



Russia's central bank said there were isolated cases of lenders' IT systems being infected. One consumer lender, Home Credit, had to suspend client operations.

Other companies that identified themselves as victims included French construction materials firm Saint Gobain, US drugmaker Merck & Co and Mars Inc's Royal Canin pet food business.

India-based employees at Beiersdorf, makers of Nivea skin care products, and Reckitt Benckiser, which owns Enfamil and Lysol, told Reuters the ransomware attack had impacted some of their systems in the country.

Western Pennsylvania's Heritage Valley Health System's entire network was shut down by a cyber attack on Tuesday, according to local media reports.

Last's month's fast-spreading WannaCry ransomware attack was crippled after a 22-year-old British security researcher Marcus Hutchins created a so-called "kill-switch" that experts hailed as the decisive step in slowing the attack.


Cyber intelligence firm Flashpoint said it believed the outbreak began in Ukraine, where attackers loaded the ransomware onto computers when they requested updates of a widely used accounting software program.

