A global cyberattack leveraging hacking tools believed to have been developed by the US National Security Agency (NSA) infected tens of thousands of computers in nearly 100 countries, including Taiwan, disrupting Britain’s health system and global shipper FedEx.
Extortionists tricked people into opening malware attachments to spam e-mails that appeared to contain invoices, job offers, security warnings and other legitimate files.
The ransomware encrypted data on the computers, demanding payments of US$300 to US$600 to restore access.
Photo: AP
Security researchers said they observed some people paying via the digital currency bitcoin, although they did not know what percent had given in to the extortionists.
Researchers with security software maker Avast said they had observed 57,000 infections in 99 countries, with Taiwan, Russia and Ukraine the top targets.
Asian countries reported no major breaches yesterday, but officials in the region were scrambling to check and the full extent of the damage might not be known for some time.
China’s Xinhua news agency said some secondary schools and universities had been affected, without specifying how many or identifying them.
The most disruptive attacks were reported in Britain, where hospitals and clinics were forced to turn away patients after losing access to computers on Friday.
International shipper FedEx Corp said some of its Windows computers were also infected.
“We are implementing remediation steps as quickly as possible,” FedEx said in a statement.
Only a small number of US-headquartered organizations were hit, because the hackers appear to have begun the campaign by targeting organizations in Europe, said Vikram Thakur, research manager with security software maker Symantec.
By the time they turned their attention to the US, spam filters had identified the new threat and flagged the ransomware-laden e-mails as malicious, Thakur said.
Infections of the worm appeared to have fallen off significantly after a security researcher bought a domain that the malware was connecting to, by chance undermining its effectiveness.
“The numbers are extremely low and coming down fast,” he said, but added that any change in the original code could lead to another flare up.
The US Department of Homeland Security said late on Friday that it was aware of reports of the ransomware, was sharing information with domestic and foreign partners, and was ready to lend technical support.
Telecom company Telefonica was among many targets in Spain, though it said the attack was limited to some computers on an internal network and had not affected clients or services.
Portugal Telecom and Telefonica Argentina both said they were also targeted.
Private security firms identified the ransomware as a new variant of “WannaCry” that had the ability to automatically spread across large networks by exploiting a known bug in Microsoft’s Windows operating system.
The hackers, who have not come forward to claim responsibility or otherwise been identified, likely made it a “worm,” or self-spreading malware, by exploiting a piece of NSA code known as “Eternal Blue” that was released last month by a group known as the Shadow Brokers, researchers with several private cybersecurity firms said.
“This is one of the largest global ransomware attacks the cybercommunity has ever seen,” said Rich Barger, director of threat research with Splunk, one of the firms that linked WannaCry to the NSA.
The Shadow Brokers released Eternal Blue as part of a trove of hacking tools that they said belonged to the US spy agency.
Microsoft said it was pushing out automatic Windows updates to defend clients from WannaCry. It issued a patch on March 14 to protect them from Eternal Blue.
Britain’s National Cyber Security Center said teams were working “round the clock” to restore computer systems after hospitals had to cancel or delay treatment for patients.
British Home Secretary Amber Rudd said that 45 public health organizations were hit, but she stressed that no patient data had been stolen.
The attack froze computers at hospitals across the country, with some canceling all routine procedures.
Taiwan has experienced its most significant improvement in the QS World University Rankings by Subject, data provided on Sunday by international higher education analyst Quacquarelli Symonds (QS) showed. Compared with last year’s edition of the rankings, which measure academic excellence and influence, Taiwanese universities made great improvements in the H Index metric, which evaluates research productivity and its impact, with a notable 30 percent increase overall, QS said. Taiwanese universities also made notable progress in the Citations per Paper metric, which measures the impact of research, achieving a 13 percent increase. Taiwanese universities gained 10 percent in Academic Reputation, but declined 18 percent
BULLY TACTICS: Beijing has continued its incursions into Taiwan’s airspace even as Xi Jinping talked about Taiwan being part of the Chinese family and nation China should stop its coercion of Taiwan and respect mainstream public opinion in Taiwan about sovereignty if its expression of goodwill is genuine, the Ministry of Foreign Affairs (MOFA) said yesterday. Ministry spokesman Jeff Liu (劉永健) made the comment in response to media queries about a meeting between former president Ma Ying-jeou (馬英九) and Chinese President Xi Jinping (習近平) the previous day. Ma voiced support for the so-called “1992 consensus,” while Xi said that although the two sides of the Taiwan Strait have “different systems,” this does not change the fact that they are “part of the same country,” and that “external
UNDER DISCUSSION: The combatant command would integrate fast attack boat and anti-ship missile groups to defend waters closest to the coastline, a source said The military could establish a new combatant command as early as 2026, which would be tasked with defending Taiwan’s territorial waters 24 nautical miles (44.4km) from the nation’s coastline, a source familiar with the matter said yesterday. The new command, which would fall under the Naval Command Headquarters, would be led by a vice admiral and integrate existing fast attack boat and anti-ship missile groups, along with the Naval Maritime Surveillance and Reconnaissance Command, said the source, who asked to remain anonymous. It could be launched by 2026, but details are being discussed and no final timetable has been announced, the source
SHOT IN THE ARM: The new system can be integrated with Avenger and Stinger missiles to bolster regional air defense capabilities, a defense ministry report said Domestically developed Land Sword II (陸射劍二) missiles were successfully launched and hit target drones during a live-fire exercise at the Jiupeng Military Base in Pingtung County yesterday. The missiles, developed by the Chungshan Institute of Science and Technology (CSIST), were originally scheduled to launch on Tuesday last week, after the Tomb Sweeping Day holiday long weekend, but were postponed to yesterday due to weather conditions. Local residents and military enthusiasts gathered outside the base to watch the missile tests, with the first one launching at 9:10am. The Land Sword II system, which is derived from the Sky Sword II (天劍二) series, was turned