Advertisement

Countries, companies brace for 'second wave' Monday of cyberattack

By Allen Cone
The Royal London Hospital, in Central London, Britain, was one of a number of hospitals and institutions operated by Britain's National Health Service hit by a large-scale ransomware cyberattack, causing failures to computer systems. Photo by Will Oliver/EPA
The Royal London Hospital, in Central London, Britain, was one of a number of hospitals and institutions operated by Britain's National Health Service hit by a large-scale ransomware cyberattack, causing failures to computer systems. Photo by Will Oliver/EPA

May 14 (UPI) -- Cyber security experts are warning of a "second wave" of a computer attacks, expected Monday, after an "unprecedented" attack hit of 200,000 computers in more than 150 countries on Friday.

The ransomware, called WannaCry, locks down files on an infected computer and asks the computer's administrator to pay a ransom to regain control of them.

Advertisement

Copycat versions of the malicious software have begun to spread, according to experts.

"We are in the second wave," said Matthieu Suiche of Comae Technologies, a cybersecurity company based in the United Arab Emirates said to The New York Times. "As expected, the attackers have released new variants of the malware. We can surely expect more."

On Sunday, MalwareTech urged users to immediately install a security patch for older versions of Microsoft's Windows, including Windows XP. Windows 10 was not affected.

Advertisement

Microsoft had released a security patch in March, but computers and networks that hadn't updated their systems were at risk. Microsoft said it had taken the "highly unusual step" of releasing a patch for computers running older operating systems.

Britain's National Health Service was among the victims. NHS computers were frozen and the agency was asked to pay $300 in bitcoins, the equivalent of about $527,000.

Other targets included FedEx in the United States, the Spanish telecom giant Telefónica, the French automaker Renault, universities in China, Germany's federal railway system and Russia's Interior Ministry, according to The New York Times.

"At the moment, we are in the face of an escalating threat," Rob Wainwright, the executive director of Europol, the European Union's police agency, told the British network ITV on Sunday. "The numbers are going up. I am worried about how the numbers will continue to grow when people go to work and turn their machines on Monday morning.

"The latest count is over 200,000 victims in at least 150 countries. Many of those will be businesses including large corporations."

Banks have largely escaped the global attack "because they've learned from painful experience of being the number one target for cybercrime," Wainwright said.

Advertisement

Other sectors around the world were bracing for trouble.

"This is crucial for businesses when reopening on Monday: Please beware and anticipate, and take preventive steps against the WannaCry malware attack," Indonesia's communication and information minister, Rudiantara, who uses only one name, said at a news conference.

Britain's defense minister, Michael Fallon, said Sunday on BBC the government was spending about $64 million to improve cybersecurity at the National Health Service, which has been running on Windows XP, software no longer supported by Microsoft.

Two opposition parties, the Labor Party and the Liberal Democrats said the governing Conservative Party had not done enough to prevent the attack. The general election is scheduled for June 8.

Robert Pritchard, a former cybersecurity expert at Britain's defense ministry, said hackers are staying ahead of governments and companies.

"This vulnerability still exits; other people are bound to exploit it," he said. "The current variant will make its way into antivirus software. But what about any new variants that will come in the future?"'

The was virus stopped late Friday by a 22-year-old British researcher who uses the Twitter handle MalwareTech. The man identifying the Web domain for the hackers' "kill switch" and disabled the malware. He registered the domain to analyze the attack but realized the ransomware needed it to remain unregistered in order to continue spreading.

Advertisement

A hacker could change the code to remove the domain and try the ransomware attack again.

Latest Headlines