Expert who stopped spread of attack by activating software’s ‘kill switch’ says criminals will ‘change the code and start again’ 
 
 The “accidental hero” who halted the global spread of an unprecedented ransomware attack by registering a garbled domain name hidden in the malware has warned the attack could be rebooted. 
 
 The ransomware used in Friday’s attack wreaked havoc on organisations including FedEx and Telefónica, as well as the UK’s National Health Service (NHS), where operations were cancelled, X-rays, test results and patient records became unavailable and phones did not work. 
 
 But the spread of the attack was brought to a sudden halt when one UK cybersecurity researcher tweeting as @malwaretechblog, with the help of Darien Huss from security firm Proofpoint, found and inadvertently activated a “kill switch” in the malicious software. 
 
 Cyber-attack hits 74 countries with UK hospitals among targets – live updates Read more 
 
 The researcher, who identified himself only as MalwareTech, is a 22-year-old from south-west England who works for Kryptos logic, an LA-based threat intelligence company. 
 
 “I was out having lunch with a friend and got back about 3pm and saw an influx of news articles about the NHS and various UK organisations being hit,” he told the Guardian. “I had a bit of a look into that and then I found a sample of the malware behind it, and saw that it was connecting out to a specific domain, which was not registered. So I picked it up not knowing what it did at the time.” 
 
 The kill switch was hardcoded into the malware in case the creator wanted to stop it spreading. This involved a very long nonsensical domain name that the malware makes a request to – just as if it was looking up any website – and if the request comes back and shows that the domain is live, the kill switch takes effect and the malware stops spreading. The domain cost $10.69 and was immediately registering thousands of connections every second. 
 
 MalwareTech explained that he bought the domain because his company tracks botnets, and by registering these domains they can get an insight into how the botnet is spreading. “The intent was to just monitor the spread and see if we could do anything about it later on. But we actually stopped the spread just by registering the domain,” he said. But the following hours were an “emotional rollercoaster”. 
 
 “Initially someone had reported the wrong way round that we had caused the infection by registering the domain, so I had a mini freakout until I realised it was actually the other way around and we had stopped it,” he said. 
 
 MalwareTech said he preferred to stay anonymous “because it just doesn’t make sense to give out my personal information, obviously we’re working against bad guys and they’re not going to be happy about this.” 
 
 He also said he planned to hold onto the URL, and he and colleagues were collecting the IPs and sending them off to law enforcement agencies so they can notify the infected victims, not all of whom are aware that they have been affected. 
 
 He warned people to patch their systems, adding: “This is not over. The attackers will realise how we stopped it, they’ll change the code and then they’ll start again. Enable windows update, update and then reboot.” 
 
 He said he got his first job out of school without any real qualifications, having skipped university to start up a tech blog and write software. 
 
 “It’s always been a hobby to me, I’m self-taught. I ended up getting a job out of my first botnet tracker, which the company I now work for saw and contacted me about, asking if I wanted a job. I’ve been working there a year and two months now.” 
 
 But the dark knight of the dark web still lives at home with his parents, which he joked was “so stereotypical”. His mum, he said, was aware of what had happened and was excited, but his dad hadn’t been home yet. “I’m sure my mother will inform him,” he said. 
 
 “It’s not going to be a lifestyle change, it’s just a five-minutes of fame sort of thing. It is quite crazy, I’ve not been able to check into my Twitter feed all day because it’s just been going too fast to read. Every time I refresh it it’s another 99 notifications.” 
 
 
 
 Proofpoint’s Ryan Kalember said the British researcher gets “the accidental hero award of the day”. “They didn’t realise how much it probably slowed down the spread of this ransomware”. 
 
 The time that @malwaretechblog registered the domain was too late to help Europe and Asia, where many organisations were affected. But it gave people in the US more time to develop immunity to the attack by patching their systems before they were infected, said Kalember. 
 
 Play Video 0:32 Theresa May: 'This is not targeted at the NHS, it’s an international attack' – video 
 
 The kill switch won’t help anyone whose computer is already infected with the ransomware, and it’s possible that there are other variants of the malware with different kill switches that will continue to spread. 
 
 The malware was made available online on 14 April through a dump by a group called Shadow Brokers, which claimed last year to have stolen a cache of “cyber weapons” from the National Security Agency (NSA). 
 
 Ransomware is a type of malware that encrypts a user’s data, then demands payment in exchange for unlocking the data. This attack used a piece of malicious software called “WanaCrypt0r 2.0” or WannaCry, that exploits a vulnerability in Windows. Microsoft released a patch (a software update that fixes the problem) for the flaw in March, but computers that have not installed the security update remain vulnerable. 
 
 MalwareTech (@MalwareTechBlog) I will confess that I was unaware registering the domain would stop the malware until after i registered it, so initially it was accidental. 
 
 The ransomware demands users pay $300 worth of cryptocurrency Bitcoin to retrieve their files, though it warns that the “payment will be raised” after a certain amount of time. Translations of the ransom message in 28 languages are included. The malware spreads through email. 
 
 “This was eminently predictable in lots of ways,” said Kalember. “As soon as the Shadow Brokers dump came out everyone [in the security industry] realised that a lot of people wouldn’t be able to install a patch, especially if they used an operating system like Windows XP [which many NHS computers still use], for which there is no patch.” 
 
 Security researchers with Kaspersky Lab have recorded more than 45,000 attacks in 74 countries, including the UK, Russia, Ukraine, India, China, Italy, and Egypt. In Spain, major companies including telecommunications firm Telefónica were infected. 
 
 By Friday evening, the ransomware had spread to the United States and South America, though Europe and Russia remained the hardest hit, according to security researchers Malware Hunter Team. The Russian interior ministry says about 1,000 computers have been affected. ||||| Media playback is unsupported on your device Media caption How to protect yourself online from a cyber-attack 
 
 A computer malware that has spread across 150 countries appears to be slowing down, with few reports of fresh attacks globally on Monday. 
 
 A spokesperson for police agency Europol said the situation in Europe "seems stable". 
 
 In Asia, where many offices closed before the WannaCry ransomware struck on Friday, the attack has been less severe than expected. 
 
 The ransomware takes over users' files, demanding $300 (£230) to restore them. 
 
 The White House said on Monday that under $70,000 (£54,000) had been paid in total in a bid to get any locked data released. 
 
 Payments could go up as the ransomware warned the cost would double after three days, and threatened to delete files within seven days if no payment was made. 
 
 Computer giant Microsoft said the attack, which has affected hundreds of thousands of computers, should serve as a wake-up call. 
 
 Among the organisations targeted worldwide have been Germany's rail network Deutsche Bahn, Spanish telecommunications operator Telefonica, US logistics giant FedEx and Russia's interior ministry. 
 
 What was the situation on Monday? 
 
 Many firms employed experts over the weekend to try to prevent new infections. 
 
 Senior spokesman for Europol, Jan Op Gen Oorth, told the AFP news agency: "The number of victims appears not to have gone up and so far the situation seems stable in Europe, which is a success. 
 
 "It seems that a lot of internet security guys over the weekend did their homework and ran the security software updates." 
 
 UK Health Minister Jeremy Hunt confirmed to the BBC that UK intelligence services had found no evidence of a second wave of attacks on Monday. 
 
 The badly affected National Health Service said seven out of 47 trusts that were hit were still facing serious issues. 
 
 French carmaker Renault said its plant in the northern town of Douai would not reopen on Monday as it dealt with the cyber-attack. 
 
 In Asia, the spread was reportedly slowing, with banking systems largely unaffected: 
 
 Australia : At least eight businesses reported being locked out of their systems 
 
 : At least eight businesses reported being locked out of their systems South Korea : Four companies reported problems over the weekend. One cinema chain was unable to display trailers 
 
 : Four companies reported problems over the weekend. One cinema chain was unable to display trailers Indonesia : Records at two hospitals were blocked 
 
 : Records at two hospitals were blocked Japan : Both Nissan and Hitachi reported some units had been affected, but not seriously 
 
 : Both Nissan and Hitachi reported some units had been affected, but not seriously China: Computers at nearly 30,000 institutions and organisations were affected, including government agencies and hospitals, internet firm Qihoo 360 said. Some payment systems and government services affected, but less than feared 
 
 US President Donald Trump's Homeland Security adviser Tom Bossert has also confirmed that no US federal government systems were affected. 
 
 Who is behind the attack? 
 
 This won't take long. Nobody knows. Europol's Jan Op Gen Oorth said: "A bit early to say... but we are working on a decrypting tool". 
 
 Associated Press quoted Tim Wellsmore, of US security firm FireEye, as saying: "We expect this is a small operation... They just happened to hit the mother lode." 
 
 Russian President Vladimir Putin said: "Russia has absolutely nothing to do with it." 
 
 EU Commissioner for Security Julian King told the BBC on Monday that the EU was proposing legislation to reinforce cyber security in the wake of the attack. 
 
 Some private sector security researchers say they have seen some similarities between some of the code in the recent attack and some linked to North Korea in the past. 
 
 Security officials in the UK, however, say they have not seen anything they would regard as hard evidence, Gordon Corera, the BBC's security correspondent, reports. 
 
 Should people pay? 
 
 Companies in Asia and Europe have been warning employees to be careful when clicking on attachments and links in their emails. 
 
 The message from the UK's National Crime Agency was "do not pay!" - there is no guarantee that systems will be restored. 
 
 Michael Gazeley, of Network Box, a Hong Kong-based cyber-security firm, told Reuters there were still "many 'landmines' waiting in people's inboxes", adding that his firm had detected a new version that infected users directly via a malicious link on hacked websites. 
 
 Media playback is unsupported on your device Media caption Technology explained: what is ransomware? 
 
 Becky Pinkard, from Digital Shadows, a UK-based cyber-security firm, also said it would be easy for the initial attackers or "copy-cat authors" to change the virus code so it is difficult to guard against. 
 
 A UK security researcher known as "MalwareTech", who helped to limit the ransomware attack, had predicted "another one coming... quite likely on Monday". 
 
 MalwareTech, whose name was revealed in UK media to be 22-year-old Marcus Hutchins, was hailed as an "accidental hero" after registering a domain name to track the spread of the virus, which actually ended up halting it. 
 
 What's behind Microsoft's 'wake-up call' warning? 
 
 The computing giant says the tool used in this current attack had been developed by the US National Security Agency and was stolen by hackers. 
 
 It is highly critical of the way governments store data on software vulnerabilities. 
 
 Image copyright AFP Image caption A railway station system in Chemnitz, eastern Germany, is infected 
 
 Microsoft president and chief legal officer Brad Smith said on Sunday: "We have seen vulnerabilities stored by the CIA show up on Wikileaks, and now this vulnerability stolen from the NSA has affected customers around the world. 
 
 "An equivalent scenario with conventional weapons would be the US military having some of its Tomahawk missiles stolen." 
 
 The organisation also said that many organisations had failed to keep their systems up to date, allowing the virus to spread. 
 
 Microsoft said it had released a Windows security update in March to tackle the problem involved in the latest attack, but many users were yet to run it. 
 
 How roots can be traced to the US 
 
 Get news from the BBC in your inbox, each weekday morning ||||| Patients wait near a banner informing about the delay in service put up at the registration desks at Dharmais Cancer Hospital in Jakarta, Indonesia, Monday, May 15, 2017. Dozens of the hospital's computer... (Associated Press) 
 
 TOKYO (AP) — The worldwide "ransomware" cyberattack wreaked havoc in hospitals, schools and offices across the globe on Monday. Asia reported thousands of new cases but no large-scale breakdowns as workers started the week by booting up their computers. 
 
 The full extent of the damage from the cyberattack felt in 150 countries was unclear and could worsen if more malicious variations of the online extortion scheme appear. 
 
 The initial attack, known as "WannaCry," paralyzed computers running Britain's hospital network, Germany's national railway and scores of other companies and government agencies around the world. 
 
 As a loose global network of cybersecurity experts fought the ransomware, the attack was disrupting computers that run factories, banks, government agencies and transport systems in scores of countries, including Russia, Ukraine, Brazil, Spain, India and Japan, among others. Among those hit were Russia's Interior Ministry and companies including Spain's Telefonica and FedEx Corp. in the U.S. 
 
 Chinese state media said 29,372 institutions there had been infected along with hundreds of thousands of devices. 
 
 The Japan Computer Emergency Response Team Coordination Center, a nonprofit group providing support in computer attacks, said 2,000 computers at 600 locations in Japan were reported affected. Companies including Hitachi and Nissan Motor Co. reported problems but said they said had not seriously affected their business operations. 
 
 Auto manufacturer Renault said one of its plants, which employs 3,500 people in Douai, northern France, wasn't reopening Monday as technicians dealt with the cyberattack's aftermath. The temporary halt in production was a "preventative step," Renault said, giving no details on how badly the plant was affected by the malware. 
 
 In China, universities and other educational institutions were among the hardest hit, possibly because schools tend to have old computers and be slow to update operating systems and security, said Fang Xingdong, founder of ChinaLabs, an internet strategy think tank. 
 
 On social media students complained about not being able to access their work, and people in various cities said they hadn't been able to take their driving tests over the weekend because some local traffic police systems were down. 
 
 Railway stations, mail delivery, gas stations, hospitals, office buildings, shopping malls and government services also were affected, China's Xinhua News Agency said, citing the Threat Intelligence Center of Qihoo 360, a Chinese internet security services company. 
 
 Elsewhere in Asia, the Indonesian government urged businesses to update computer security after the malware locked patient files on computers in two hospitals in the capital, Jakarta. 
 
 Patients arriving at Dharmais Cancer Hospital had to wait several hours while staff worked with paper records. 
 
 Officials in Japan and South Korea said they believed security updates had helped ward off the worst of the impact. But the South Korean cinema chain CJ CGV Co. was restoring advertising servers at dozens of theaters after the attack left the company unable to display trailers of upcoming movies. 
 
 Experts urged organizations and companies to immediately update older Microsoft operating systems, such as Windows XP, with a patch released by Microsoft Corp. to limit vulnerability to a more powerful version of the malware — or to future versions that can't be stopped. 
 
 Paying ransom will not ensure any fix, said Eiichi Moriya, a cybersecurity expert and professor at Meiji University. 
 
 "You are dealing with a criminal," he said. "It's like after a robber enters your home. You can change the locks but what has happened cannot be undone. If someone kidnaps your child, you may pay your ransom but there is no guarantee your child will return." 
 
 New variants of the rapidly replicating worm were discovered Sunday. One did not include the so-called kill switch that allowed researchers to interrupt the malware's spread Friday by diverting it to a dead end on the internet. 
 
 Ryan Kalember, senior vice president at Proofpoint Inc. which helped stop its spread, said the version without a kill switch could spread. It was benign because it contained a flaw that prevented it from taking over computers and demanding ransom to unlock files but other more malicious ones will likely pop up. 
 
 "We haven't fully dodged this bullet at all until we're patched against the vulnerability itself," Kalember said. 
 
 The attack held users hostage by freezing their computers, popping up a red screen with the words, "Oops, your files have been encrypted!" and demanding money through online bitcoin payment — $300 at first, rising to $600 before it destroys files hours later. 
 
 Just one click on an infected attachment or bad link would lead to all computers in a network becoming infected, said Vikram Thakur, technical director of Symantec Security Response. 
 
 "That's what makes this more troubling than ransomware was a week ago," Thakur said. 
 
 The attack has hit more than 200,000 victims across the world since Friday and is seen as an "escalating threat," said Rob Wainwright, the head of Europol, Europe's policing agency. 
 
 "The numbers are still going up," Wainwright said. 
 
 Microsoft's top lawyer is laying some of the blame at the feet of the U.S. government. Brad Smith criticized U.S. intelligence agencies, including the CIA and National Security Agency, for "stockpiling" software code that can be used by hackers. Cybersecurity experts say the unknown hackers who launched this weekend's "ransomware" attacks used a vulnerability that was exposed in NSA documents leaked online. 
 
 It was too early to say who was behind the onslaught, which struck 100,000 organizations, and what their motivation was, aside from the obvious demand for money. So far, not many people have paid the ransom demanded by the malware, Europol spokesman Jan Op Gen Oorth told The Associated Press. 
 
 Researchers who helped prevent the spread of the malware and cybersecurity firms worked around the clock over the weekend to monitor the situation and install the software patch. 
 
 "Right now, just about every IT department has been working all weekend rolling this out," said Dan Wire, spokesman at Fireeye Security. 
 
 Microsoft distributed the patch two months ago, which could have forestalled much of the attack, but in many organizations it was likely lost among the blizzard of updates and patches that large corporations and governments strain to manage. 
 
 ___ 
 
 Watt reported from Beijing. AP researcher Yu Bing and news assistant Liu Zheng in Beijing, John Leicester in Paris, Youkyung Lee in Seoul and Kelvin Chan in Hong Kong contributed to this report.
– The "accidental hero" who inadvertently stopped Friday's massive cyberattack that affected nearly 100 countries is a 22-year-old who lives with his parents, the Guardian reports. The British cybersecurity researcher—who's keeping anonymous to protect himself—found a nonsensical website address in the code for the ransomware holding victims' data hostage and causing chaos around the globe. He spent less than $11 to register the domain with the hope of monitoring the spread of the ransomware. But it turns out, registering the domain was a "kill switch" added by the creators of the ransomware in case they ever wanted to stop it themselves. For a more in-depth explanation, check out the 22-year-old's blog titled "How to Accidentally Stop a Global Cyber Attack." But while the spread of the ransomware has been halted for now, the world's computer systems are far from in the clear. Cybersecurity expert Matt Suiche says whoever is behind the attack—their identity is still unknown—can simply update the ransomware and start again. "I'd even say this update probably already happened," he tells ABC News. There were 75,000 individual attacks across 99 countries Friday. CNN runs down the victims, which include FedEx, Nissan, the Russian Central Bank, Britain's National Health Service, and Spain's Telefonica. Most of the attacks were in Russia, Ukraine, and Taiwan.