A GLOBAL cyber attack has spread across the world, hitting computer systems everywhere from the UK and Russia to America and the Ukraine. Here is what we know so far.
Cyber attack latest: Messages demands money on payment terminal at a branch of Ukraine's Oschadbank
The global ransomware attack is said to look similar to the WannaCry attack that hit the NHS and infected computers in more than 150 countries last month.
Experts said another piece of ransomware, described as a variant of a virus known as Petya, appeared
to be behind the cyber attack unfolding today.
But Kaspersky Lab said: “Our preliminary findings suggest that it is not a variant of Petya ransomware as publicly reported, but a new ransomeware that has not been seen before.
“That is why we have named it NotPetya. The company’s telemetry data indicates around 2,000 attacked users so far.
Ransomware is the malicious software used by hackers to block access to a computer system until a ransom is paid in bitcoins.
WHAT IS RANSOMWARE?
What do we know so far in Britain?
British advertising giant WPP confirmed that computer networks in several locations had been targeted by a "suspected cyber attack”.
In a statement, WPP said: "IT systems in several WPP companies have been affected by a suspected cyber attack.
"We are assessing the situation, taking appropriate measures and will update as soon as possible."
Ukraine's deputy PM Rozenko Pavlo tweeted this error message on his PC
American pharmaceutical company Merck has reportedly been hit by the cyber attack.
Merck tweeted: “We confirm our company's computer network was compromised today as part of global hack. Other organizations have also been affected.
“We are investigating the matter and will provide additional information as we learn more.”
Russia's Rosneft energy company also reported falling victim to hacking.
Russia's central bank said there had been "computer attacks" on Russian banks and that in isolated cases their IT systems had been infected.
All Russian branches of Home Credit consumer lender are closed because of a cyber attack, an employee of a Home Credit call centre in Russia said.
Russian steelmaker Evraz said its information systems had been hit by a cyber attack but its output was not affected.
What do we know so far in Ukraine?
There has been major disruption to the Ukrainian power grid, banks and government offices.
Chernobyl's radiation monitoring system has been affected by the cyber attack.
Ukrainian deputy prime minister Pavlo Rozenko said the computer system at the government's headquarters has been shut down.
He added: "It was an unprecedented attack, but our IT experts are doing their work and protecting strategic infrastructure.
"Important systems have not been affected."
What do we know so far in Denmark?
In Copenhagen, global shipping firm Shipping company A.P. Moller-Maersk said it had suffered a computer system outage.
A Maersk spokesman said: "We can confirm that Maersk IT systems are down across multiple sites and business units due to a cyber attack.
"We continue to assess the situation. The safety of our employees, our operations and customers' business is our top priority."
What do we know so far in Germany?
Germany's Metro said on Tuesday its wholesale stores in the Ukraine have been hit by a cyber attack and the retailer was assessing the impact.
What the ransomware behind the cyber attack?
Alan Woodward, a computer scientist at Surrey University, said: "It appears to be a variant of a piece of ransomware that emerged last year.
"It was updated earlier in 2017 by the criminals when certain aspects were defeated. The ransomware was called Petya and the updated version Petrwap."
Travis Farral, director of security strategy at Anomali, said: “While initial reports have only centred on the Ukraine being hit by a new stream of ransomware known as PetrWrap, this is a global attack.
“Just like WannaCry, organisations are locked out of their networks and a fee demanded to decrypt files, and could also be leveraging the same EternalBlue vulnerability, which attacks SMB file-sharing services.
“Bitcoin payments are currently already at $2,000+ already. But it’s essential that victims understand that payment may not actually allow them to access their data, and may just fund hackers to commit further crimes.”
A new report by Kaspersky Lab said: “In May 2016 Kaspersky Lab discovered Petya ransomware that not only encrypts data stored on a computer, but also overwrites the hard disk drive’s master boot record (MBR), leaving infected computers unable to boot into the operating system.
“The malware is a notable example of the Ransomware-as-a-Service model, when ransomware creators offer their malicious product ‘on demand’, spreading it by multiple distributors and getting a cut of the profits.
“In order to get their part of the profit, the Petya authors inserted certain “protection mechanisms” into their malware that do not allow the unauthorized use of Petya samples.”
Marco Cova, senior security researcher at Lastline, said: “The Petya attack looks very similar in its dynamics and techniques to the WannaCry ransomware that caused large disruption just a few weeks ago.
“In particular, like WannaCry, it seems to rely on the EternalBlue exploit to automatically spread from one machine to another.
“It's still early in the infection lifecycle, but obviously, if it is confirmed that the EternalBlue is the only spreading mechanism, there will be inevitable questions about how organizations could still fall to this attack after all the publicity and support tools (patches, scanning tools, etc.) that were produced as part of the WannaCry response.”
Comments
Post a Comment