A Mysterious Virus Has Infiltrated America's Drone Program

There’s something deeply wrong at Creech Air Force Base, the notorious home of America’s drone program, where pilots remotely order US Reaper and Predator drones to unleash destructive missile strikes on unsuspecting villagers in Yemen, Libya, Iraq, Syria, Afghanistan and other war zones.

Less than a week after the Department of Homeland Security advised all federal agencies using anti-virus software created by Kaspersky Labs to remove the programs from their systems immediately, Ars Technica reports that two weeks ago the Defense Information Systems Agency detected mysterious spyware embedded in the drone “cockpits” – the control stations that pilots use to control the deadly machines.

Investigators have been unable to determine the virus’s provenance, or even if it was intentionally introduced to the drone systems, or the result of an accidental infection. But perhaps the virus’s most perplexing feature is its passivity. Instead of hastening away reams of classified information, it has simply logged keystrokes.

More curious still, the virus has resisted all attempts to remove it from the Air Force’s systems.

The virus, first detected nearly two weeks ago by the military’s Host-Based Security System, has not prevented pilots at Creech Air Force Base in Nevada from flying their missions overseas. Nor have there been any confirmed incidents of classified information being lost or sent to an outside source. But the virus has resisted multiple efforts to remove it from Creech’s computers, network security specialists say. And the infection underscores the ongoing security risks in what has become the US military’s most important weapons system.

“We keep wiping it off, and it keeps coming back,” says a source familiar with the network infection, one of three that told Danger Room about the virus. “We think it’s benign. But we just don’t know.”

Military network security specialists aren’t sure whether the virus and its so-called “keylogger” payload were introduced intentionally or by accident; it may be a common piece of malware that just happened to make its way into these sensitive networks. The specialists don’t know exactly how far the virus has spread. But they’re sure that the infection has hit both classified and unclassified machines at Creech. That raises the possibility, at least, that secret data may have been captured by the keylogger, and then transmitted over the public internet to someone outside the military chain of command.

As Ars notes, drones have become America’s weapon of choice for waging stealth warfare across the Middle East and Africa, a fact that was underlined by the killing of four US green berets in Niger earlier this week. The military advisers were serving at a waystation for American drones that were used to carry out attacks on nearby Al Qaeda affiliates.

Drones have become America’s tool of choice in both its conventional and shadow wars, allowing US forces to attack targets and spy on its foes without risking American lives. Since President Obama assumed office, a fleet of approximately 30 CIA-directed drones have hit targets in Pakistan more than 230 times; all told, these drones have killed more than 2,000 suspected militants and civilians, according to the Washington Post. More than 150 additional Predator and Reaper drones, under US Air Force control, watch over the fighting in Afghanistan and Iraq. American military drones struck 92 times in Libya between mid-April and late August. And late last month, an American drone killed top terrorist Anwar al-Awlaki — part of an escalating unmanned air assault in the Horn of Africa and southern Arabian peninsula.

And while they represent America’s most sophisticated weaponry in the never-ending war on terror, the drone program has well-known security flaws. Last fall, the US Air Force investigated a secure network outage in early September at Creech. Around the time of the outage, there were three incidences of drones striking three unintended targets. The Air Force said it was just a coincidence. 

But despite their widespread use, the drone systems are known to have security flaws. Many Reapers and Predators don’t encrypt the video they transmit to American troops on the ground. In the summer of 2009, US forces discovered “days and days and hours and hours” of the drone footage on the laptops of Iraqi insurgents. A $26 piece of software allowed the militants to capture the video.

Authorities believe the virus was spread by the use of remote drives used by technicians to upload maps and other data to the drone piloting systems, which are “air gapped” from the rest of the Air Force’s systems.

Use of the drives is now severely restricted throughout the military. But the base at Creech was one of the exceptions, until the virus hit. Predator and Reaper crews use removable hard drives to load map updates and transport mission videos from one computer to another. The virus is believed to have spread through these removable drives. Drone units at other Air Force bases worldwide have now been ordered to stop their use.

But given the hysteria surrounding Kaspersky’s software allegedly being used as a tool for espionage by the Russian government, how long until this breach is connected with a broader narrative about Russian hackers trying to destabilize American society?

Or, worse – how much longer until a malicious actor manages to seize control of America’s drone program and harness its destructive capabilities for its own ends?

If Wannacry cyber attack didn’t make you wannacry, the next one will!

The Wannacry malware that hit like a global mega-bomb, showed everyone how vulnerable we are to a global cyber attack. Billed as “one of the largest global ransomware attacks the cyber community has ever seen,” the infection started in London and then emerged almost instantly in Seattle, New York, and Tokyo. Within ten minutes, the coordinated attack became epidemic throughout the world, covering the better part of every continent but Antarctica. By the end of one day, the malware had infected over 200,000 computers in 150 nations, encrypting all their data and locking the users out.

While the attackers demanded a ransom in order to free hostage computers, the small number of companies that paid the ransom required for unlocking the encryption did not get their data back, raising a question of whether the primary goal was really money or mayhem. (If primary goal was making a lot of quick money, it would make more sense to quickly release data so that more companies would be inclined to pay the ransom, seeing that payment solved the problem.)

This was a cyber attack equal in scale to something Dr. Evil would create or some Bond villain would use to collect ransom from the entire world … or to control the world. This time, it didn’t win, but there are some interesting reasons why as you did deeper.

Top levels of governments ordered emergency meetings to try to quickly understand and stem the spread of this very destructive piece of warware. A solution emerged quickly because an anonymous British researcher discovered the virus was built with a kill switch. With each infection the virus would check to see if a particular website was running and issuing a kill command. If no command, the virus would begin its mission of destruction. The researcher discovered the website, which was dormant, and activated it, slamming the brakes on global destruction. This bought time for people to apply Microsoft’s patch before the attackers could launch a modified version of the virus. Furthermore, the destructive code was only able to infect computers that had not upgraded with the latest Microsoft patch; so damage was hugely mitigated.

Even so, ATM’s and gas pumps in China went dark, as did Chinese government and university computers. Hospitals in the UK shut down. Forty-five facilities were affected, forcing cancelation or delay of some medical treatments. Nissan’s plant in the UK got hit. French automaker, Renault, stopped production in order to stop spread of the virus. Spain’s Telefónica and Russia’s communications giant, Megafon, got hit. Russia’s central bank and government agencies received “massive” attacks, which Russia claimed were successfully overcome.

The latest data I saw showed 370,000 computers infected and locked up, but that didn’t appear to include less available information from China. The damage is still unfolding, though greatly slowed; but a second variant began spreading across the globe on Tuesday, and other variants may emerge.

Epidemiology of the viral attack — North Korea suspect

The New York Times reports that the ransomware hack appears to have originated from North Korean sleeper cells.

Since the 1980s, the reclusive North has been known to train cadres of digital soldiers to engage in electronic warfare and profiteering exploits against its perceived enemies, most notably South Korea and the United States…. When the instructions from Pyongyang come for a hacking assault, they are believed to split into groups of three or six, moving around to avoid detection…. Security officials in South Korea, the United States and elsewhere say it is a well-known fact that the North Korean authorities have long trained squads of hackers and programmers, both to sabotage computers of adversaries and make money for the government, including through the use of ransomware — malicious software that blackmails victims into paying to release seized files…. Choi Sang-myung, an adviser to South Korea’s cyberwar command and a security researcher at Hauri Inc., said that the arithmetic logic in the ransomware attacks … is similar to that used in previous attacks against Sony Pictures and the Swift international bank messaging system — both of them traced to North Korea. (NYT)

Of course, The New York Times has been saying for months that Russia hacked DNC emails and interfered with US election without yet coming up with a shred of solid evidence or producing sources willing to go on record. It’s also fairly simple to create a decoy to the actual origin of attack. If it’s true, however, it underscores North Korea’s desire to create random destruction and financial loss indiscriminately throughout the world and its ability to do so.

The NYT points out several other attacks around the world in recent years with similar signatures that pointed back to North Korea and to the fact that these attacks often happen at the same time as a North Korean missile or nuclear test. Unlike the tests, however, these attacks would be considered actual acts of war if they could be definitely pinned on some national government. They created financial destruction, in the very least, by setting companies back with lost data and lost time in recovery. They pillaged by collecting ransoms. In the past, they have stolen data and then used it to damage a company, as happened with Sony Pictures.

As Microsoft’s president and chief legal officer, Brad Smith, wrote on his blog …

An equivalent scenario with conventional weapons would be the US military having some of its Tomahawk missiles stolen.

I’d say that is an understatement because Microsoft has no desire to officially intensify concerns about the security of its operating systems.

China, North Korea’s neighbor, where it is believed many of the sleeper cells have been planted, got hit the hardest. China said 30,000 Chinese organizations were infected and hundreds of thousands of computers. That could be due to China taking sides with President Trump and pressuring North Korea on its nuclear weapons development, or the larger-scale assault in China could be far less nefarious. China is the motherland of pirated software, and pirated Microsoft software does not get security upgrades, making it more vulnerable to such attacks. China may have only been hit the hardest because such is the vulnerability of a sleazy economy built on pirating just about everything.

The fact that the lines connecting all the hacks to North Korea — or more importantly to the North Korea government — remain a little fuzzy may keep nations from retaliating against what would be acts of war if they were known to be government actions.

The fact that ransom seems to have played a very small roll in a very large “ransomware” attack begs the question as to whether this was a government operation masquerading as a ransom attack. Was it North Korean revenge for Trump’s tough stance and China’s capitulation, or was it a US false-flag test of the effectiveness of a global attack, designed to disparage North Korea at the same time and to be cut off before any great damage was done? The presence of a single kill switch that could shut the whole thing down is a fail-safe that implies an operation by a group or nation who wanted to make sure the virus could be stopped. Who of all highly computerized nations was damaged the least?

While the latter is more intriguing (in the most heinous sort of way), Occam’s Razor says the simplest answer is most likely the right one. I personally find it hard to believe the US government would be that reckless with its allies, but it is an outside possibility. The US is, regardless, seriously culpable, even if it did not launch the attack.

US Origin of the viral agents

While North Korea may have launched the viral attack, the origins of the virus’s development go much deeper and do appear to come home to rest in the US.

Microsoft sought to shift blame to the US government for “stockpiling code” that can be used by malicious attackers. What they didn’t say is what we have known since Edward Snowden’s revelation, which is that software corporations in cooperation with the US government, including Microsoft, have built hatch doors into their code for US intelligence agencies to use.

The Swiss-cheese-like holes built throughout software systems and networks for backdoor access by the US government allow the government to sniff through or shut down systems all over the world for the sake of national security. However, as was more recently revealed by Wikileaks, these security measures have a very insecure downside: once the hatch doors are known by hackers, there is nothing to stop ordinary hackers from sliding the bolt and getting in through those same doors, which gives ordinary hackers extraordinary powers.

The problem, however, lies even deeper in the machinations of the US government than just getting software manufacturers to build back doors into all your personal computing devices. The US government’s software designed to exploit those back hatches is now available to the entire world. What we have here is leaked warware:

 

The attacks on Friday appeared to be the first time a cyberweapon developed by the N.S.A., funded by American taxpayers and stolen by an adversary had been unleashed by cybercriminals against patients, hospitals, businesses, governments and ordinary citizens….

 

Former intelligence officials have said that the tools appeared to come from the N.S.A.’s “Tailored Access Operations” unit, which infiltrates foreign computer networks. (The unit has since been renamed.) The attacks on Friday are likely to raise significant questions about whether the growing number of countries developing and stockpiling cyberweapons can avoid having those same tools purloined and turned against their own citizens….

 

The attacks on Friday are likely to raise significant questions about whether the growing number of countries developing and stockpiling cyberweapons can avoid having those same tools purloined and turned against their own citizens. (The New York Times)

Snowden, seeing the grave danger posed by the NSA’s spying and irresponsible nature, tweeted, “Whoa: @NSAGov decision to build attack tools targeting US software now threatens the lives of hospital patients,” indicating it was a leaked NSA cyberwar tool, created by the NSA which attacked the UK’s hospital system…. “Despite warnings, @NSAGov built dangerous attack tools that could target Western software. Today we see the cost.” (The Free Thought Project)

I would suspect the deeper reality is that the hole in microsoft’s software was not one some government “found,” but was one of those hatches built in by government demand. When the government’s software for exploiting that patch became public domain, either the government or Microsoft decided to make the ready antidote (their patch) immediately available.

Russia, Snowden’s sanctuary, has blamed the United States’ National Security Agency, saying it is NSA software that was leaked out of US control via Wikileaks that was used to create the Wannacry attack. The NSA, in masterminding and then letting leak its own black software, has placed the power of cyberwar in an unquantifiable number of unknown hands with unknown intentions. It’s really no different than if the US let weapons-grade nuclear material slip into the hands of terrorists.

Here’s an even more apt comparison: The concern over government engineered computer viruses escaping and infecting the general population of computers is similar to the concern in past years over government-engineered living viruses, designed for germ warfare, escaping and infecting the general population.

Now, take this warware security risk one step further. What kind of international crisis might be created if a US biological weapons virus escaped containment and broadly infected the world? Turn the question a little: What kind of international crisis might be created if a US computer virus broadly infected the world?

We saw this kind of problem emerge from the Stuxnet virus that the United States and Israel developed jointly to destroy centrifuges in Iran in order to stall its nuclear development during negotiations. Later, elements of that virus appeared in destructive code use for lesser attacks all over the world.

“This is almost like the atom bomb of ransomware,” Mr. Belani [chief executive of PhishMe, an email security company] said, warning that the attack “may be a sign of things to come.” (NYT)

You see, this is really warware — powerful destructive government cyber weapons that can be used equally for spying or for infecting and destroying enemies — slipping into the hands of enemies around the world. When the US designs biological viruses for war, it also creates antidotes to its human-engineered destruction for its own population or to limit collateral damage to friendly nations. And THAT is most likely why the solution to this massive attack came so quick with patches already available and being distributed.

Thanks to the US government’s inept security of its darkest software in inadvertent partnership with Wikileaks, more than a dozen government spying and hacking programs have been made generally available to the entire world, and Apple, Microsoft and others have been rapidly issuing security updates.

Snowden asks,

If NSA builds a weapon to attack Windows XP—which Microsoft refuses to patches—and it falls into enemy hands, should NSA write a patch?

I ask a bigger question: “IF NSA builds such a weapon and it falls into enemy hands bringing death and financial destruction around the world, should the USA be held responsible to pay for all the damages? Should the entire world hold it guilty? This is the potential level of risk we’re talking about. If you create the destructive engine exploited by hacker’s viruses and let it get away, aren’t you as liable as you are if you engineer a viral disease and let it escape into the world, killing off millions of people? The hospital situation in the UK shows how people can actually die because of this kind of weaponry.

The NSA is clearly inept at policing its nuclear-size cyberweapon stash. It has allowed small and formerly insignificant people like Edward Snowden, hired through contracted services, to leak out vast amounts of information about its work. It has allowed large amounts warware to get to Wikileaks and from there to all evil hands in the world that want it. This is cyber-nuclear proliferation that all appears to have happened due to NSA security breaches. Imagine if it were actual nuclear material or highly contagious incurable germs. We’d be demanding that heads roll for such repeated loss of control.

Even the US is vulnerable to attacks by its own weaponized viruses

This was our shot over the bow. In this case, the weakness in the software that was exploited was already known and the patch had already been made and was even in place on most computers. Thus, the damage was limited. Think of how this attack — extensive as it was — would have been exponentially worse, had the vulnerability in Microsoft’s operating system and the solution not already been in place as well as readily available to those who were delinquent in upgrading.

The United States has known about this kind of vulnerability for years, and it has been reported for years but we are still built on infrastructure that is widely vulnerable to attack. While we may have antidotes that can be released as patches if we know a computer virus or software engine used to make a virus work has slipped out, our infrastructure remains vulnerable to all kinds of attack agents that other nations are making that we may know nothing about.

We can see that in the government’s response to last week’s cyber attack:

President Trump ordered the federal government to prepare for a devastating cyber attack against America’s electric grid amid growing fears foreign states are set to carry out attacks aimed at plunging the nation into darkness.

 

A presidential order signed Thursday directed key federal agencies to assess preparations for a prolonged power outage resulting from cyber attacks designed to disrupt the power grid.

 

An assessment of the danger must be carried out by the Energy Department, Homeland Security, DNI and state and local governments to examine the readiness of the United State to manage a shutdown of the power grid. The assessment will also identify gaps and shortcomings in efforts that would be used restore power.

 

New cyber security measures outlined in the executive order come as the commander of Cyber Command warned two days earlier that America’s critical infrastructure is vulnerable to disruption by foreign cyber attacks. (The Washington Free Beacon)

Now that it’s obvious that small malicious powers in foreign nations already have NSA/CIA-level malware that is already being used to shut down computers all over the world, do you really think the government is going to resolve the vulnerabilities of our energy systems, transportation systems, communications systems, financial systems, and government data systems, before some malicious group or nation (like North Korea or Iran) manages to create much more mayhem than was accomplished this time?

In 2015, China stole 22 million records of federal employees, including sensitive personal data. Therefore, we know the government has already had two years to prepare; so, why are we just seeing new orders go out to analyze our points of vulnerability to hacking and viral attacks? This year has become all about accusations that Russia created a cybercoup and overthrew the US election to install its own Manchurian candidate or just to mess us up with confusion.

Apparently, we’d rather pile up national debt on more desirable (as in fun or feel-good) things than cyber security or on more conventional weapons.

Wannacry is a sign of things to come

Wannacry is a warning shot over the bow. A much more extensive viral infection could shut down the world in one day tomorrow or next week if it exploits parts of Microsoft’s OS that Microsoft hasn’t yet patched, and if the back door is that allows the virus to be shut down is not as obvious as this one was or if it has now back door that is intended as a kill switch. Financial systems (both stock markets and banks) could be wiped out in a day, triggering the need for an immediate global financial reset.

Imagine if your bank got locked out by ransomware from all of your financial data, so they couldn’t even tell you are their customer and couldn’t even access their backup data. The bank would have no record of how much money you have in the bank. Then imagine no one really intended to collect any ransom at all — so there was no opportunity to retrieve the data. Instead, the virus simply destroyed it to wreak havoc in the world or to destroy the world’s superpower.

This is where you might want some of you money to be held in physical gold. I don’t sell gold, but I do have a link in the left sidebar to a company that can help you reset your retirement funds to hold physical gold and other physical assets if you are so inclined.

Ransomware Is Tip Of The Iceberg: “You Could See 90% Of Americans Die As A Result Of A Prolonged Power Outage Because The Grid Gets Hacked” (VIDEO)

The Ransomware that began spreading across the globe on Friday is still going with more computers reportedly being affected today by new variants of the virus.

What we’ve learned is that the attack hasn’t just taken down personal computers, but core government and business networks affecting everything from health care systems and transportation in Europe, to ATM withdrawals in China.

It’s massive, to be sure. But in the grand scheme of things, up to this point, it has been a fairly minor inconvenience.

But as Joe Joseph warns in his latest news report at The Daily Sheeple, this is just the tip of the iceberg, because now that we’ve seen how quickly such an attack can spread, it’s only a matter of time before rogue groups or state-sponsored players make a direct attempt at taking down core systems that keep millions of people in America alive. As we’ve previously noted, U.S. cyber command has warned that power grids, physical infrastructure and commerce systems will be a major target of future cyber attacks, and the latest Ransomware attack utilizing NSA-created exploits proves just how serious the damage could be:

Experts are saying this is just the tip of the iceberg… what the NSA has done and the damage they have caused as the result of coming up with these exploits in the first place is criminal… but it’s beyond criminal… in our society we have become so dependent on technology.. our computers… our cell phone…

We’ve become so hooked on it that if something happens and it looks like it can very easily happen… where some of these hacks are exploited… we could see an instantaneous change in the way that we live… to the point where you could see upwards of 80% or 90% of the population just in the United States dying as a result of a prolonged power outage because the grid gets hacked…

(Watch full report at Youtube)

Joseph’s figure of a 90% die off in the event of a grid failure is based on the work of EMP researcher Dr. Peter Pry, who recently testified before a Congressional panel on the dangers of “grid down” scenarios resulting from electro-magnetic pulse attack. Though Pry’s research is primarily based on the threat of a nuclear device being detonated a couple hundred miles above the central United States taking out the entirety of the domestic power grid, the end result of a grid-down scenario, whether initiated by a cyber attack or something else, is very much the same.

Without the grid, all life in America would come to a standstill. Gas station pumps wouldn’t work, which means trucks couldn’t deliver food to grocery stores. And even if your local store still had food on the shelves, cash registers and bank payment verification systems would be unavailable, making hard currency like gold and silver the only means of transacting. As we’ve seen in China over the weekend, ATM’s would likely be inaccessible. So, too, would be your access to clean water, as most utility plants are tied to the power grid.

In short, within about 72 hours, there would be pandemonium in the streets, as highlighted by The Prepper’s Blueprint author Tess Pennington in her article The Anatomy of a Breakdown:

3-5 days following a disaster is the bewitching hour. During this short amount of time, the population slowly becomes a powder keg full of angry, desperate citizens. A good example is the chaos that ensued in New Orleans following the absence of action from the local government or a timely effective federal response in the aftermath of Hurricane Katrina. In such troubled times, people were forced to fend for themselves and their families, by any means necessary. This timeline of Hurricane Katrina effectively illustrates “the breakdown,” and within three days, the citizens of New Orleans descended into anarchy, looting and murder.

If the crisis extends for any more than about a week, you can expect full-out war on the streets of America as people race to acquire the last remaining resources.

Within one year, predicts Peter Pry, nine out of ten Americans would be dead because of starvation or violence.

It may sound incredible, but if you consider the reality of our dependence on technology, a multi-week or multi-month hiccup in the system will be enough to bring the entire thing crashing down.

Even the Department of Homeland Security recently warned about the potential for devastating cyber attacks, going so far as to recommend that families need to prepare at least two weeks of food and emergency supplies because the federal government may be overwhelmed and unable to provide assistance.

"It's Much Bigger Than WannaCry": New Stealthy Cyberattack Could Dwarf Last Week's Global Worm Epidemic

Another large-scale, stealthy cyberattack is underway on a scale that could dwarf last week"s assault on computers worldwide, a global cybersecurity firm told AFP on Wednesday.

Meet Adylkuzz - the new cyberattack that "is much bigger than WannaCry."

Instead of completely disabling an infected computer by encrypting data and seeking a ransom payment, Adylkuzz uses the machines it infects to "mine" in a background task a virtual currency, Monero, and transfer the money created to the authors of the virus.

Proofpoint said in a blog that symptoms of the attack include loss of access to shared Windows resources and degradation of PC and server performance, effects which some users may not notice immediately.

"As it is silent and doesn"t trouble the user, the Adylkuzz attack is much more profitable for the cyber criminals. It transforms the infected users into unwitting financial supporters of their attackers," said Godier.

Proofpoint said it has detected infected machines that have transferred several thousand dollars worth of Monero to the creators of the virus. The firm believes Adylkuzz has been on the loose since at least May 2, and perhaps even since April 24, but due to its stealthy nature was not immediately detected. Proofpoint"s vice president for email products, Robert Holmes, told AFP...

"We don"t know how big it is" but "it"s much bigger than WannaCry",

"We have seen that before -- malwares mining cryptocurrency -- but not this scale," said Holmes.

It uses the hacking tools recently disclosed by the NSA "in a more stealthy manner and for a different purpose." As InfoRiskToday details...

The SMB flaw (file-sharing network protocol) targeted by this Adylkuzz campaign existed in all versions of Windows since XP and came to light in April, via a dump of "Equation Group" tools released by the Shadow Brokers.

Many security experts believe the Equation Group is the National Security Agency, and that the Shadow Brokers may be part of a psychological operations campaign run by Russian intelligence.

One of the Equation Group exploits included in the April dump, called EternalBlue, is designed to exploit the SMB flaw in Windows. If successful, the Equation Group would then often install a backdoor called DoublePulsar onto the exploited endpoint to give it persistent, quiet access to the system.

Rather than freeze files demanding a ransom, Adylkuzz uses the hundreds of thousands of infected computers to mine virtual currency... As InfoRiskToday details...

The WannaCry outbreak began May 12. But Proofpoint says that the Adylkuzz campaign that targeted DoublePulsar and EternalBlue appears to have begun as early as April 24 - nearly three weeks earlier - and hasn"t stopped.

"This attack is ongoing and, while less flashy than WannaCry, is nonetheless quite large and potentially quite disruptive," Kafeine says in a Monday blog post.

In addition, Proofpoint reports that multiple outbreaks that were attributed to the WannaCry campaign, but which involved no ransom notice, may, in fact, have instead been part of the Adylkuzz campaign.

As with WannaCry, the Adylkuzz malware first attempts to exploit a system via EternalBlue, and if successful then infects the endpoint with DoublePulsar, Kafeine says.

"Once running, Adylkuzz will first stop any potential instances of itself already running and block SMB communication to avoid further infection, Kafeine says. "It then determines the public IP address of the victim and download the mining instructions, cryptominer, and cleanup tools."

This Adylkuzz campaign is mining not for the world"s most well-known cryptocurrency, but rather for monero.

Also known as XMR, InfoRiskToday notes that the creators of the cryptocurrency claim that it"s more private and difficult to trace than bitcoin. Unlike bitcoin, it also has no hardcoded block size limit, meaning that - at least in theory - an infinite amount of monero could be mined.

So far it"s not clear who"s behind this cryptocurrency mining operation. A version of WannaCry seen in February contains code that was used in a 2015 attack tied to Lazarus - a hacking group security experts say ties to North Korea. But anyone could have reused the 2015 code, which is publicly available, Matt Suiche, managing director at incident response firm Comae Technologies, tells Cyberscoop.

"Attribution can always be faked, as it"s only a matter of moving bytes around," he says.

As InfoRiskToday.com concludes ominously, the discovery of the cryptocurrency mining botnet shows that organizations that fail to patch their systems aren"t just at risk from flashy attacks, such as WannaCry, but also stealthier attacks that don"t always announce their presence.

New Variant Of "WannaCry" Virus Emerges Infecting 3,600 Computers Per Hour

Update: according to the latest data from Check Point Software, cited by Reuters, a new variant of the WannaCry ransomware is now infecting on average 3,600 computers per hour.

BREAKING: Check Point Software says it found new variant of "WannaCry" virus infecting 3,600 computers an hour

— Reuters Tech News (@ReutersTech) May 15, 2017

* * *

Governments and companies around the world began to gain the upper hand against the first wave of the unrivaled global cyberattack this morning.

More than 200,000 computers in at least 150 countries have so far been infected, according to Europol, the European Union’s law enforcement agency. The U.K.’s National Cyber Security Centre said new cases of so-called ransomware are possible “at a significant scale.”

"For now, it does not look like the number of infected computers is increasing," said a Europol spokesman. "We will get a decryption tool eventually, but for the moment, it’s still a live threat and we’re still in disaster recovery mode."

The initial attack was stifled when a security researcher disabled a key mechanism used by the worm to spread, but experts warned the hackers were likely to mount a second attack because so many users of personal computers with Microsoft operating systems couldn’t or didn’t download a security patch released in March that Microsoft had labeled “critical.”

“I will confess that I was unaware registering the domain would stop the malware until after I registered it, so initially it was accidental,” wrote the researcher, who uses the Twitter name @MalwareTechBlog.

“So long as the domain isn’t revoked, this particular strain will no longer cause harm, but patch your systems ASAP as they will try again.”

But the world is still digging out...

Europol executive director Rob Wainwright told Britain"s ITV television on Sunday that the attack had been "unprecedented". "We"ve never seen anything like this," he said.

In China, "hundreds of thousands" of computers were affected, including petrol stations, cash machines and universities, according to Qihoo 360, one of China"s largest providers of antivirus software. The malware affected computers at “several” unspecified Chinese government departments, the country’s Cyberspace Administration said on its WeChat blog Monday. Since that initial attack, agencies and companies from the police to banks and communications firms have put preventive measures in place, while Qihoo 360 Technology Co., Tencent Holdings Ltd. and other cybersecurity firms have begun making protection tools available, the internet overseer said.

French carmaker Renault said its Douai plant, one of its biggest sites in France employing 5,500 people, would be shut on Monday as systems were upgraded.

At Germany’s national Deutsche Bahn railroad, workers were laboring under "high pressure" Monday to repair remaining glitches with train stations’ electronic departure boards, a spokesman said.

In Japan, Hitachi Ltd. said that some of its computers had been affected.

In South Korea, CJ CGV Co., the country’s largest cinema chain, said advertising servers and displays at film theaters were hit by ransomware. Movie servers weren’t affected and are running as normal, it said in a text message Monday.

Indonesia’s government reported two hospitals in Jakarta were affected.

About 97 percent of U.K. facilities and doctors disabled by the attack were back to normal operation, Home Secretary Amber Rudd said Saturday after a government meeting. At the height of the attack Friday and early Saturday, 48 organizations in the NHS were affected, and hospitals in London, North West England and Central England urged people with non-emergency conditions to stay away as technicians tried to stop the spread of the malicious software.

As Microsoft"s president and chief legal officer, Brad Smith, said in a blog post Sunday:

"An equivalent scenario with conventional weapons would be the US military having some of its Tomahawk missiles stolen," Smith wrote.

"The governments of the world should treat this attack as a wake up call."

And waking up they seem to be...(as Axios notes)

President Trump"s homeland security adviser, Tom Bossert, said that Friday"s global cyberattack is something that "for right now, we"ve got under control" in the U.S., reports AP:

"Bossert tells ABC"s "Good Morning America" that the malware is an "extremely serious threat" that could inspire copycat attacks. But Microsoft"s security patch released in March should protect U.S. networks for those who install it."

"Micrsoft"s top lawyer has criticized U.S. intelligence for "stockpiling" software code that can aid hackers. Cybersecurity experts say the unknown hackers behind the latest attacks used a vulnerability exposed in U.S. government documents leaked online."

"Bossert said "criminals" are responsible, not the U.S. government. Bossert says the U.S. hasn"t ruled out involvement by a foreign government, but that the recent ransom demands suggest a criminal network."

However, new variants of the rapidly replicating malware were discovered Sunday. One did not include the so-called kill switch that allowed researchers to interrupt the malware"s spread Friday by diverting it to a dead end on the internet.

As Bloomberg reports that Matt Suiche, founder of United Arab Emirates-based cyber security firm Comae Technologies warns a new version of the ransomware may have also been spreading over the weekend.

About 50% of machines that would have spread the infection by the second variation of the malware have Russian I.P. addresses, according to Suiche.

Over 40,000 machines appear to have been infected by the second variation of the malware already.

Ryan Kalember, senior vice president at Proofpoint Inc., which helped stop its spread, said the version without a kill switch could spread. It was benign because it contained a flaw that prevented it from taking over computers and demanding ransom to unlock files but other more malicious ones will likely pop up.

"We haven"t fully dodged this bullet at all until we"re patched against the vulnerability itself," Kalember said.

Microsoft Slams NSA For Letting Its Hacking Tools Cause Global Malware Epidemic

In early April, when we reported that the hacker group known as the Shadow Brokers had released the password to NSA"s "Top Secret Arsenal" of tools that allowed anyone to "back door" into virtually any computer system (in what it claimed was a protest of Trump"s betrayal), few people noticed. On Friday, however, the entire world did notice when an unknown group of hackers reportedly used the same set of NSA-created tools to launch a global malware cyberattack using the WannaCry ransomware virus, holding at least 200,000 computer systems around the globe hostage, and demanding a payment of $300 in bitcoin to unlock infected computers, or else threatening to wipe out the contents of the host machine.

The crippling, global attack prompted Europol to warn that Monday could be a dark day for an unknown number of Windows XP-based systems which could simply fail to start, leading to massive productivity losses around the globe, while others predicted that the spread of the worm could accelerate in the coming days once the hackers bypass the temporary measure that prevented further distribution of the worm over the weekend.

Meanwhile, on Sunday afternoon, Microsoft itself got involved in the global hacking scandal and criticized the NSA for its role in spreading the WannaCry epidemic; specifically the tech giant urged governments to use and store their cyber warfare tools responsibly.

“We have seen vulnerabilities stored by the CIA show up on WikiLeaks, and now this vulnerability stolen from the NSA has affected customers around the world,” Microsoft President and Chief Legal Officer Brad Smith wrote in a blog post this afternoon. “This attack provides yet another example of why the stockpiling of vulnerabilities by governments is such a problem.”

Ahead of the Shadow Brokers" leak of the NSA hacking tools, Microsoft had released a patch against the vulnerability one month prior, on March 14, which indicates that the company was notified by the US intelligence agency that their tools using that particular backdoor had been compromised. However, older, unsupported operating systems such as Windows XP were not included in the update, in addition to millions of used who do not update their systems regularly. As a result, the WannaCry malware infected more than 200,000 unpatched computers, and was threatening to spread to countless more as the hacker further weaponized their virus.

Needless to say, Microsoft was not happy.

"Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage" Smith wrote, adding that an "an equivalent scenario with conventional weapons would be the U.S. military having some of its Tomahawk missiles stolen. And this most recent attack represents a completely unintended but disconcerting link between the two most serious forms of cybersecurity threats in the world today – nation-state action and organized criminal action."

Microsoft"s Chief Legal Officer also said the latest attack should serve as a “wake-up call” to world governments who should urgently establish a common set of strategies to deal with cyber threats.

“The governments of the world should treat this attack as a wake-up call. They need to take a different approach and adhere in cyberspace to the same rules applied to weapons in the physical world,” Smith wrote. “We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits.”

Smith also acknowledged Microsoft’s responsibility for failing to prevent the attack by not notifying all customers to install the patch on time, but noted that cybersecurity is a “shared responsibility” between tech companies and customers.

“We take every single cyberattack on a Windows system seriously, and we’ve been working around the clock since Friday to help all our customers who have been affected by this incident,” MSFT"s President added.

Meanwhile, a global manhunt is currently underway to determine the source of the cyberattack. According to the European Cybercrime Centre, Europol is “working closely” with countries affected by the blitz to identify the culprits. Microsoft too is contributing to the investigation. “Working through our Microsoft Threat Intelligence Center (MSTIC) and Digital Crimes Unit, we’ll also share what we learn with law enforcement agencies, governments, and other customers around the world,” Smith wrote.

As we reported earlier, the narrative is already set to determine that the culprits were most likely Russians.

The full blog post by the Microsoft President and Chief Legal Officer can be found here.

"Over 200,000 Infected": Europol Fears Computers Simply Won't Start Monday After "Unrivalled" Global Cyberattack

There was a silver lining in what has been dubbed the "world"s biggest ransomware attack" - it struck on Friday mid-afternoon (in Europe), just as businesses were winding down for the weekend, and as a result the full impact of the forced system shutdowns would not be fully felt over the weekend when businesses and infrastructure are generally operating at a subdued pace. However, with the weekend coming to a close, the full extent of the inflicted damage may become apparent in just a few hours.

That was the warning by Europol Executive Director Rob Wainwright who on ITV’s “Peston on Sunday” broadcast, said that additional disruptions are likely as people return to work Monday and turn on their desktop systems, and as a result the "unrivaled" global cyberattack is poised to continue claiming victims.

The moment @Peston pushed the Director of @Europol @rwainwright67 over whether the Government ignored their advice on cyber crime #Peston pic.twitter.com/8WluSuMYkZ

— Peston on Sunday (@pestononsunday) May 14, 2017

Speaking to ITV’s, Wainwright added the attack was indiscriminate across the private and public sectors.

“At the moment we are in the face of an escalating threat, the numbers are going up, I am worried about how the numbers will continue to grow when people go to work and turn their machines on Monday morning."

“The latest count is over 200,000 victims in at least 150 countries. Many of those will be businesses including large corporations.”

“We’ve seen the rise of ransomware becoming the principal threat, I think, but this is something we haven’t seen before -- the global reach is unprecedented,” Wainwright also said. He also said that organisations across the globe, including investigators from the National Crime Agency (NCA), are now working non-stop to hunt down those responsible for the ransomware.

As we reported on Saturday, the initial attack was halted when a security researcher disabled a key mechanism used by the worm to spread, but experts said the hackers were likely to mount a second attack because so many users of personal computers with Microsoft operating systems couldn’t or didn’t download a security patch released in March that Microsoft had labeled “critical.” Microsoft said in a blog post Saturday that it was taking the “highly unusual“ step of providing the patch for older versions of Windows it was otherwise no longer supporting, including Windows XP and Windows Server 2003.

As the WSJ confirms, the attacks could worsen on Monday morning because of how the virus works.

The virus contains two parts. One is the ransomware, which locks the computer files and displays a message saying that the files will be locked and eventually destroyed unless the user sends payment over the internet to the hacker.

The other part is known as the "spreader." Once the virus makes its way onto one computer--perhaps when a user opens an infected email attachment--the spreader transmits itself to other computers on the network.

The British researcher, who wishes to be identified only as MalwareTech, found a kill switch in the spreader. The spreader was designed to contact a web address to see whether it should further spread itself, but hackers hadn"t bought that web address. So MalwareTech did, and effectively stopped the virus"s spread. It meant that one computer in a network could be infected, but the worm wouldn"t spread to the rest of the network.

Cybersecurity experts expect the latest versions of the worm to have no kill switch for the spreader. So when workers return to the office Monday morning and turn on their computers, they might open an infected email attachment or connect an already-infected laptop to their organization"s non-security-patched network and spread the worm.

There was some good news: having tipped their hand on Friday, and allowing hacking countermeasures to be implemented, about 97% of U.K. facilities and doctors disabled by the attack were back to normal operation, Home Secretary Amber Rudd said Saturday after a government meeting. As reported on Friday, at the height of the attack Friday and early Saturday, 48 organizations in the NHS were affected, and hospitals in London, North West England and Central England urged people with non-emergency conditions to stay away as technicians tried to stop the spread of the malicious software.

“There will be lessons to learn from what appears to be the biggest criminal cyber-attack in history,” Rudd said cited by Bloomberg in response to a letter from Jonathan Ashworth, the shadow secretary of state for health.

Meanwhile, according to Tom Robinson, chief operating officer and co-founder of Elliptic Enterprises Ltd., a ransomware consultant that works with banks and companies, victims have already paid about $30,000 in ransom so far, with the total expected to rise substantially next week, said . Robinson, in an interview by email, said he calculated the total based on payments tracked to Bitcoin addresses specified in the ransom demands. The number, which is likely a conservative estimate, will only embolden the hackers to become even more aggressive in their next attack.

Ransomware is a particularly stubborn problem because victims are often tricked into allowing the malicious software to run on their computers, and the encryption happens too fast for security software to catch it. Some security expects calculate that ransomware may bring in as much as $1 billion a year in revenue for the attackers.

According to Bloomberg, last year an acute-care hospital in Hollywood paid $17,000 in bitcoin to an extortionist who hijacked its computer systems and forced doctors and staff to revert to pen and paper for record-keeping.

On one hand, it is probable that the weekend gave many companies the opportunity to prepare for the next ransomware attack: "While any sized company could be vulnerable, many large organizations with robust security departments would have prioritized the update that Microsoft released in March and wouldn’t be vulnerable to Friday’s attack."

Even so, it does not explain why some of the world"s biggest corporations were so strikingly unprepared for Friday"s events. 

A spokesman for Spain’s Telefonica SA said the hack affected some employees at its headquarters, but the phone company is attacked frequently and the impact of Friday’s incident wasn’t major. FedEx said it was “experiencing interference,” the Associated Press reported.

Renault halted production at some factories to stop the virus from spreading, a spokesman said Saturday, while Nissan’s U.K. car plant in Sunderland, in northeast England, was affected without causing any major impact on business, an official said.

In Germany, Deutsche Bahn faced “technical disruptions” on electronic displays at train stations, but travel was unaffected, the company said in a statement on its website. Newspaper reports showed images of a ransomware message on display screens blocking train information.

Russia’s Interior Ministry, with oversight of the police forces, said about “1,000 computers were infected,” which it described as less than 1 percent of the total, according to its website.

Indonesia’s government reported two hospitals in Jakarta were affected.

Meanwhile, the latest anti-Russia narrative is growing.

"There is a high probability that Russian-language cybercriminals were behind the attack" said Aleks Gostev, chief cybersecurity expert for Kaspersky Labs. “Ransomware is traditionally their topic,” he said. “The geography of attacks that hit post-Soviet Union most also suggests that.” In retrospect, what more convenient confluence of events could there be than having a handy justification for Q2 GDP missing again - just blame it on the computer virus - and accusing Russia of being responsible for the latest global slowdown.

The NSA’s Virus Can Still Destroy Your Data, Here Are 5 Ways to Make Sure It Won’t

Thanks to the NSA’s apparent lust to know and see everything, agency-designed ransomware virus was unleashed on the planet yesterday, leaving anyone using a Windows system — corporations, governments, and even those who only post cat pictures online — vulnerable to exploitation for a price.

That price — $300 in Bitcoin, increasing after a given time period — would theoretically have to be paid in order to rid the infected computer of the WanaCrypt ransomware, or the victim would lose everything on their system. Ransomware literally holds your data hostage until the fee asked by attackers is paid — but if you don’t pay, you lose everything.

Everything.

WanaCrypt0r, alternately known as WanaCry, WanaCrypt, or WCry, is believed to have infected no less than 126,500 computers in 99 countries prior to the threat being partially abated — but not before it had wrought havoc on the U.K.’s National Health Service, FedEx, Spanish telecommunications company, Telefónica, and other systems around the globe.

“This is one of the largest global ransomware attacks the cyber community has ever seen,” Splunk director of threat research, Rich Barger, told Reuters. Splunk is one of several firms who divined WanaCrypt0r’s origins with the National Security Agency.

Analysts say the particularly infectious worm exploited a Microsoft software flaw, and, although the company issued a patch in March after identifying WCry in February, not all users had updated their systems accordingly.

Cybersecurity experts worked at a fever pitch to stop the malicious worm, but it took what the Guardian termed an “accidental hero” to bring a tentative halt to the pandemonium. Reports the outlet, a Twitter user, “tweeting as @malwaretechblog, with the help of Darien Huss from security firm Proofpoint, found and inadvertently activated a ‘kill switch’ in the malicious software.”

He “halted the global spread of an unprecedented ransomware attack by registering a garbled domain name hidden in the malware has warned the attack could be rebooted.”

And payment of the $10.69 registration fee — temporary, though the end to the exploit may be — was all it took.

A significant risk could still be lurking — after all, the attackers used tools designed by the NSA, whose entire collection of older hacking tools were leaked online last month by an entity calling itself the Shadow Brokers, and WCry could yet mutate or be altered — but there are a few ways to stay safe and prevent having precious data and files wrested from you.

1. Update, update, update

As tech outlet, Tom’s Guide, notes, “If you’ve not installed the March, April or May Windows Update bundles, do so immediately. It’s worth shutting down your system for a few minutes if it gives you a chance to avoid this.”

Windows Vista users will be protected through the March or April update bundles, and Microsoft has since issued a patch for Windows XP and its 2003 server — while the company released information to help customers cope with the ransomware virus.

2. Don’t fall hook, line, or sinker

Although WanaCrypt exploits the aforementioned Windows vulnerability, people must be vigilant — as always — not to fall for online phishing schemes, as this malware could also have been spread randomly in hopes people would open email from an unfamiliar source.

Be exceedingly cautious when visiting websites and opening attachments — WanaCry could be ready to pounce. Use common sense — and pepper it with extraordinary discretion.

3. Back it up

Cybersecurity experts constantly harangue the rest of us to backup important data and files, and — while that directive might generate an eyeroll, and grumblings about time and energy — backing up one’s system is an imperative which now cannot be ignored.

Storing vital information in a secondary location, such as a USB storage stick or external hard drive, could save you tears and headaches in the long run — particularly if WCry or another variant takes control of your system. Cloud storage could be an option — depending on which cloud you use, as the original NSA leaker and insider, Edward Snowden, has warned — but would also leave your data vulnerable in other ways.

4. Get your defenses up

Install solid, reputable antivirus software — particularly one targeting ransomware — as a line of defense against the intrusion. Experts now say WanaCrypt appears to be “wormable,” which, Tom’s Guide explains, means it spreads “from system to system by itself as a computer worm, rather than relying on human interaction as a Trojan horse, or infecting desktop applications like a traditional computer virus.”

Since most antivirus software protects and updates in real time, even if the worm breaks through your defenses, RT points out, “chances are good that within a short while an automatic antivirus update will clear the intruder from your system. Most antivirus companies offer trial versions free of charge to test before subscribing for a paid service, which should be enough if one needs to urgently remove a stray malware.”

Forbes reports, “If you have up-to-date malware protection software from a reputable cybersecurity company such as Avast installed on your computer, you are probably protected.  Check your cybersecurity company’s website to make sure you are. WanaCry is a world-wide, runaway threat. If your cybersecurity company’s website has nothing to say about it, don’t assume you are protected. Make sure you are running the current version of Windows.”

5. Keep your money

Perhaps the most basic instruction most analysts and security pros emphasize is also difficult for many to swallow. Don’t shell out the money they’re demanding — be it Bitcoin, dollars, gold, or any other iteration.

Of course, those holding your files hostage for money hope to exploit you in two insidious ways — first, by locking down your data, but second, through your emotional panic resultant from having your critical files abruptly unavailable. That alarm pumps you full of adrenaline, and could provoke a response which seems the simplest solution in the moment — forking over the funds.

If you do that, cybersecurity analysts say, no guarantee exists you’ll actually get your data back — and your willingness to do so could make you a target for future exploits — which, again, could be coming around anytime.

***

Considering the scope of the documents leaked by the Shadow Brokers, virtually anything could be possible now. This basic list will only help to an extent, and should not be considered comprehensive — nor should it be considered, of course, expert advice.

That said, the precautions offered are a bit better than leaving your system naked to malicious infection.

That “accidental hero” credited with truncating the worm’s virulent proliferation admonished the public to be wary and alert, because — although altered or ‘improved’ iterations of WanaCrypt have yet to appear online — “they will.”

“This is not over,” he told the Guardian. “The attackers will realise how we stopped it, they’ll change the code and then they’ll start again. Enable Windows update, update and then reboot.”

24 Hours Later: "Unprecedented" Fallout From "Biggest Ransomware Attack In History"

24 hours after it first emerged, it has been called the first global, coordinated ransomware attack using hacking tools developed by the NSA, crippling over a dozen hospitals across the UK, mass transit around Europe, car factories in France and the UK, universities in China, corporations in the US, banks in Russia and countless other mission-critical businesses and infrastructure.

According to experts, "this could be one of the worst-ever recorded attacks of its kind." The security researcher who tweets and blogs as MalwareTech told The Intercept, “I’ve never seen anything like this with ransomware,” and “the last worm of this degree I can remember is Conficker.” Conficker was a notorious Windows worm first spotted in 2008; it went on to infect over 9 million computers in nearly 200 countries.

The fallout, according to cyber-specialists, has been "unprecedented": it has left unprepared governments, companies and security experts from China to the United Kingdom on Saturday reeling, and racing to contain the damage from the audacious cyberattack that spread quickly across the globe, raising fears that people would not be able to meet ransom demands before their data are destroyed.

As reported yesterday, the global efforts come less than a day after malicious software, transmitted via email and stolen from the National Security Agency, exposed vulnerabilities in computer systems in almost 100 countries in one of the largest “ransomware” attacks on record. The cyberattackers took over the computers, encrypted the information on them and then demanded payment of $300 or more from users in the form of bitcoin to unlock the devices.

The ransomware was subsequently identified as a new variant of "WannaCry" that had the ability to automatically spread across large networks by exploiting a known bug in Microsoft"s Windows operating system.

The ransomware has been identifed as WannaCry

The hackers, who have not come forward to claim responsibility or otherwise been identified, likely made it a "worm", or self spreading malware, by exploiting a piece of NSA code known as "Eternal Blue" that was released last month by a group known as the Shadow Brokers (see "Hacker Group Releases Password To NSA"s "Top Secret Arsenal" In Protest Of Trump Betrayal") , researchers with several private cyber security firms said.

"This is one of the largest global ransomware attacks the cyber community has ever seen," said Rich Barger, director of threat research with Splunk. The extremely well coordinated attack first emerged in the United Kingdom around noon on Friday and spread like wildefire around the globe. According to the Times "it has set off fears that the effects of the continuing threat will be felt for months, if not years" and raised questions about the intentions of the hackers: Did they carry out the attack for mere financial gain or for other unknown reasons?

The animated map below shows the speed and scale of the global infestation which took just a few hours to cover the globe:

Animated map of how tens of thousands of computers were infected with ransomware https://t.co/LDFCW9K5Ls pic.twitter.com/E5Ep9KesaV

— The New York Times (@nytimes) May 13, 2017

Meanwhile, some of the world’s largest institutions and government agencies have been affected, including the Russian Interior Ministry, FedEx in the United States and Britain’s National Health Service. As people fretted over whether to pay the digital ransom or lose data from their computers, experts said the attackers might pocket more than $1 billion worldwide before the deadline ran out to unlock the machines.

Across Asia, several universities and organizations said they had been affected. In China, the virus hit the computer networks of both companies and universities, according to the state-run news media. News about the attack began trending on Chinese social media on Saturday, though most attention was focused on university networks, where there were concerns about students losing access to their academic work. The attack, however, focused on the UK and Europe where in addition to the British healthcare system, companies like Deutsche Bahn, the German transport giant; Telefónica, a Spanish telecommunications firm; and Renault, the French automaker, said some of their systems had been affected.

"Seeing a large telco like Telefonica get hit is going to get everybody worried," said Chris Wysopal, chief technology officer with cyber security firm Veracode.

The British National Health Service said that 45 of its hospitals, doctors’ offices and ambulance companies had been crippled — making it perhaps one of the largest institutions affected worldwide. Surgical procedures were canceled and some hospital operations shut down as government officials struggled to respond to the attack.

“We are not able to tell you who is behind that attack,” Amber Rudd, Britain’s home secretary, told the British Broadcasting Corporation on Saturday. “That work is still ongoing.”

Things only got worse on Saturday as auto production facilities across Europe have been shuttered, including car plants in the UK and France, in the aftermath of the cyberattack.

#BREAKING Renault says production halted at French sites after cyberattack

— AFP news agency (@AFP) May 13, 2017

Sky News understands production at the Nissan factory in Sunderland has been affected as a result of a cyber attack

— Sky News Newsdesk (@SkyNewsBreak) May 13, 2017

In total, more than 75,000 computers in 99 countries were compromised in Friday’s attack, with a heavy concentration of infections in Russia and Ukraine, according to Dutch security company Avast Software BV. Russia’s Interior Ministry, with oversees the country’s police forces, said “around 1,000 computers were infected,” which it described as less than 1 percent of the total, the New York Times reported. The ministry said technicians had stopped the attack and were updating the department’s “antivirus defense systems,” according to the Times. Russia"s RIA reported that the central bank said on Saturday it had detected "massive" cyber attacks on domestic banks, which successfully thwarted them.

* * *

There has been some good news: an ingenious discovery appears to have halted the spread of the virus for now. 

As part of the digital attack, the hackers included a way of disabling the malware in case they wanted to shut down their activities, Ars Technica reported. To do so, the assailants included code in the ransomware that would stop it from spreading if the virus sent an online request to a website created by the attackers. The kill switch would stop the malware from spreading as soon as the website went online and communicated with the spreading digital virus.

A British-based researcher, who declined to give his name, registered a
domain that he noticed the malware was trying to connect to, limiting
the worm"s spread. When the 22-year-old British researcher, whose Twitter handle is @MalwareTechBlog, confirmed his involvement but insisted on anonymity because he did not want the public scrutiny, saw that the kill switch’s domain name — a long and complicated set of letters — had yet to be registered, he bought it himself. By making the site go live, the researcher shut down the hacking attack before it could fully spread to the United States.

However, this temporary workaround will only last for a few days if not hours.

“I will confess that I was unaware registering the domain would stop the malware until after I registered it, so initially it was accidental,” wrote the @MalwareTechBlog researcher. “So long as the domain isn’t revoked, this particular strain will no longer cause harm, but patch your systems ASAP as they will try again.”

I will confess that I was unaware registering the domain would stop the malware until after i registered it, so initially it was accidental.

— MalwareTech (@MalwareTechBlog) May 13, 2017

“The kill switch is why the U.S. hasn’t been touched so far,” said Matthieu Suiche, founder of Comae Technologies, a cybersecurity company in the United Arab Emirates. “But it’s only temporary. All the attackers would have to do is create a variant of the hack with a different domain name. I would expect them to do that.”

Adds Reuters: "We are on a downward slope, the infections are extremely few, because the malware is not able to connect to the registered domain," said Vikram Thakur, principal research manager at Symantec.

"The numbers are extremely low and coming down fast." But the attackers may yet tweak the code and restart the cycle. The British-based researcher who may have foiled the ransomware"s spread told Reuters he had not seen any such tweaks yet, "but they will."

* * *

Meanwhile, questions are mounting why code created by the NSA. has i) fallen in the wrong hands and ii) is being used to hold the world hostage. As the NYT notes, the ability of the cyberattack to spread so quickly was partly because of its high level of sophistication.

The malware, experts said, was based on a method that the N.S.A. is believed to have developed as part of its arsenal of cyberweapons. Last summer, a group calling itself the “Shadow Brokers” posted online digital tools that it had stolen from the United States government’s stockpile of hacking weapons.  The connection to the N.S.A. is likely to draw further criticism from privacy advocates who have repeatedly called for a clampdown on how the agency collects information online.

Brian Lord, a former deputy director for intelligence and cyber operations at Government Communications Headquarters, Britain’s equivalent to the N.S.A., said that any investigation, which would include the F.B.I. and the National Crime Agency of Britain, would take months to name the potential attackers, if it ever does. And by focusing the attacks on large institutions with a track record of not keeping their technology systems up-to-date, global criminal organizations were cherry-picking easy targets that were highly susceptible to such hacks, according to Mr. Lord.

“Serious organized crime is looking to these new technologies to the maximum effect,” Mr. Lord said. “With cybercrime, you can operate globally without leaving where you already are.”

He added of this attack: “It was well thought-out, well timed and well coordinated. But, fundamentally, there is nothing unusual about its delivery. It is still fundamentally robbery and extortion.”

For now, the victims - both actual and potential - may have bought themselves some time. As part of the efforts to combat the attack, Microsoft, whose Windows software lies at the heart of the potential hacking vulnerability, released a software update available to those affected by the attack and others who could be potential targets. Microsoft took the “highly unusual” step of securing early operating systems in the wake of a massive ransomware attack that wreaked havoc on global computer networks, including the UK’s National Health Service. Overnight, Microsoft XP received the new security patch three years after the computer giant discontinued support for the OS.

“Seeing businesses and individuals affected by cyberattacks, such as the ones reported today [Friday], was painful,” a Microsoft statement read. “We are taking the highly unusual step of providing a security update for all customers to protect Windows platforms that are in custom support only, including Windows XP, Windows 8, and Windows Server 2003.”

Security experts however said the upgrade came too late for many of the tens of thousands of machines that were locked out and whose data could be erased if people did not pay the ransom. Earlier this year, Microsoft created a patch called MS17-010 to guard against the virus. But older, unsupported operating systems were not included in the update.

Making matters worse, government officials and industry watchers also warned on Saturday that other hackers might now try to use the global ransomware attack for their own means, potentially tweaking the code and developing their own targets for new cyberattacks.

* * *

Finally, there is the question who is behind this coordinated global attack. Not surprisingly, Russia has been named. There is a high-probability that Russian-language cyber-criminals were behind the attack, said Aleks Gostev, chief cybersecurity expert for Kaspersky Labs. “Ransomware is traditionally their topic,” he said cited by Bloomberg. “The geography of attacks that hit post-Soviet Union most also suggests that.”

Whoever is the responsible party behind this first, global, coordinated ransomware attack, the have demonstrated one thing: the world is thoroughly unprepared for cyberwar.

“As with everything in cyber, we’re now waiting for the next type of attack,” Paul Bantick, a cyber security expert at Beazley, a global insurance underwriter, told the NYT.

“Ransomware like this has been on the rise over the last 18 months,” he added. “This represents the next step that people were expecting.”

As such, it is only a matter of time now before an even greater, more destructive cyberattack is unleashed on the world.