The fallout from an unprecedented global cyberattack which has hit more than 200,000 victims could worsen Monday as people return to work, European and British policing and security agencies warned.
An international manhunt was under way for the plotters behind the world’s biggest-ever computer ransom assault which has affected more than 150 countries.
The indiscriminate attack, which began Friday, struck banks, hospitals and government agencies, exploiting known vulnerabilities in old Microsoft computer operating systems.
US package delivery giant FedEx, European car factories, Spanish telecoms giant Telefonica, Britain’s health service and Germany’s Deutsche Bahn rail network were among those hit.
Europol executive director Rob Wainwright said the situation could worsen on Monday when workers return to their offices after the weekend and log on.
“We’ve never seen anything like this,” the head of the European Union’s policing agency told Britain’s ITV television, calling its reach “unprecedented.”
Wainwright described the cyberattack as an “escalating threat.”
“I’m worried about how the numbers will continue to grow when people go to work and turn on their machines on Monday,” he said.
The warning was echoed by Britain’s National Cyber Security Center: “As a new working week begins it is likely, in the UK and elsewhere, that further cases of ransomware may come to light, possibly at a significant scale.”
The 5,500-strong Renault factory in Douai, northern France, one of the most important car plants in the country, will not open on Monday due to the attack, sources told AFP.
Images appear on victims’ screens demanding payment of $300 (275 euros) in the virtual currency Bitcoin, saying: “Ooops, your files have been encrypted!“
Payment is demanded within three days or the price is doubled, and if none is received within seven days the locked files will be deleted, according to the screen message.
Bitcoin, the world’s most-used virtual currency, allows anonymous transactions via heavily encrypted codes.
Experts and governments alike warn against ceding to the demands and Wainwright said few victims so far had been paying up.
Security firm Digital Shadows said on Sunday that transactions totalling $32,000 had taken place through Bitcoin addresses used by the ransomware.
The culprits used a digital code believed to have been developed by the US National Security Agency — and subsequently leaked as part of a document dump, according to researchers at the Moscow-based computer security firm Kaspersky Lab.
A hacking group called Shadow Brokers released the malware in April, claiming to have discovered the flaw from the NSA, Kaspersky said.
The attack is unique, according to Europol, because it combines ransomware with a worm function, meaning once one machine is infected, the entire internal network is scanned and other vulnerable machines are infected.
The attack therefore spread faster than previous, smaller-scale ransomware attacks.
Microsoft said the situation was “painful” and that it was taking “all possible actions to protect our customers.”
It issued guidance for people to protect their systems, while taking the highly unusual step of reissuing security patches first made available in March for Windows XP and other older versions of its operating system.
Vicente Diaz, a security analyst at Kaspersky, said big companies would have spent the weekend implementing such measures, but smaller firms without a dedicated security team could still suffer from the malware.
“This particular wave of malware was under control for most of the people, but this could change in the next hours if the attacker wants to release a second version,” he told AFP.
Symantec said the majority of organizations affected were in Europe.
Europol’s Wainwright said few banks in Europe had been affected, having learned through the “painful experience of being the number one target of cybercrime” the value of having the latest cybersecurity in place.
Russia’s interior ministry said some of its computers had been hit, while the country’s banking system was also attacked, although no problems were detected, as was the railway system.
French carmaker Renault was forced to stop production at sites in France, Slovenia and Romania, while FedEx said it was “implementing remediation steps as quickly as possible.”
Germany’s rail operator Deutsche Bahn said its station display panels were affected.
England’s National Health Service said 47 organizations providing care had been hit and on Sunday afternoon seven hospitals were continuing to divert patients from the emergency room.
Universities in China, Italy and Greece were also hit.
Meanwhile G7 finance ministers meeting in Italy vowed to unite against cybercrime, as it represented a growing threat to their economies and should be tackled as a priority.
The danger will be discussed at the G7 leaders’ summit next month.

Source: Arab News