Ukraine government, banks and electricity grid hit hardest, but companies in France, Denmark and Pittsburgh, Pennsylvania also attacked 
 
 Victims of a major ransomware cyberattack that has spread through the US and Europe can no longer unlock their computers even if they pay the ransom. 
 
 The “Petya” ransomware has caused serious disruption at large firms including the advertising giant WPP, French construction materials company Saint-Gobain and Russian steel and oil firms Evraz and Rosneft. 
 
 Petya cyber-attack: Cadbury factory hit as ransomware spreads to Australian businesses Read more 
 
 Infected computers display a message demanding a Bitcoin ransom worth $300. Those who pay are asked to send confirmation of payment to an email address. However, that email address has been shut down by the email provider. 
 
 “We do not tolerate any misuse of our platform,” said the German email provider Posteo in a blog post. 
 
 This means that there is no longer any way for people who decide to pay the ransom to contact the attacker for a decryption key to unlock their computer. 
 
 “This is not an experienced ransomware operator,” said Ryan Kalember, senior vice-president of cybersecurity strategy at Proofpoint. 
 
 The attack was first reported in Ukraine, where the government, banks, state power utility and Kiev’s airport and metro system were all affected. The radiation monitoring system at Chernobyl was taken offline, forcing employees to use hand-held counters to measure levels at the former nuclear plant’s exclusion zone. 
 
 The food giant Mondelez, legal firm DLA Piper, Danish shipping and transport giant AP Moller-Maersk and Heritage Valley Health System, which runs hospitals and care facilities in Pittsburgh, also said their systems had been hit by the malware. 
 
 WPP said in a statement that the computer systems at several of its subsidiary companies had been affected, adding that it was “assessing the situation and taking appropriate measures”. 
 
 
 
 In an internal memo to staff, one WPP firm said it was the target of “a massive global malware attack, affecting all Windows servers, PCs and laptops”. It warned employes to turn off and disconnect all machines using Windows. 
 
 Some technology experts said the attack appeared consistent with an “updated variant” of a virus known as Petya or Petrwrap, a ransomware that locks computer files and forces users to pay a designated sum to regain access. 
 
 But analysts at cyber security firm Kaspersky Labs said they had traced the infections to “a new ransomware that has not been seen before”. The “NotPetya” attack had hit 2,000 users in Russia, Ukraine, Poland, France, Italy, the UK, Germany and the US, Kaspersky said. 
 
 Anis (@0xUID) Kaspersky Lab analysts say new attacks are not a variant of #Petya ransomware as publicly reported, but a new ransomware they call NotPetya! pic.twitter.com/zLwKNOR2VL 
 
 Last month’s WannaCry or WannaCrypt ransomware attack affected more than 230,000 computers in over 150 countries, with the UK’s national health service, Spanish phone giant Telefónica and German state railways among those hardest hit. 
 
 
 
 Symantec cyber security experts said they had confirmed the ransomware in the current attack was using the same exploit – a program that takes advantage of a software vulnerability - as WannaCry. 
 
 The exploit - called EternalBlue - was leaked by the Shadow Brokers hacker group in April and is thought to have been developed by the US National Security Agency. 
 
 To spread within companies that installed the patch to protect themselves against WannaCry, the Petya ransomware appears to have two other ways of spreading rapidly within an organisation, by targeting the network’s administrator tools. 
 
 It’s not yet clear how computers became infected with the ransomware in the first place, but it doesn’t seem to be through email as happened with WannaCry, said Kalember. 
 
 Pictures circulating on social media on Tuesday of screens purportedly affected by the attack showed a message stating, “Your files are no longer accessible because they have been encrypted,” and demanding a $300 ransom in the Bitcoin digital currency. 
 
 
 
 Ankit singh (@ankit5934) New #ransomware spreading through SMB... Its #rebooting OS and encrypting files. Any idea which one it is? pic.twitter.com/DaEyqIKBvH 
 
 The attack affected all business units at Maersk, including container shipping, port and tug boat operations, oil and gas production, drilling services, and oil tankers, the company said, as well as seventeen container terminals. 
 
 
 
 “We can confirm that Maersk IT systems are down across multiple sites and business units due to a cyber-attack,” the Copenhagen-based firm said on Twitter. “We continue to assess the situation.” 
 
 The disruptions in Ukraine follow a rash of hacking attempts on state websites in late 2016 and a succession of attacks on the national electricity grid that prompted security chiefs to call for improved cyber defences. 
 
 The country’s prime minister, Volodymyr Groysman, said the attack was “unprecedented” but vital systems had not been affected. “Our IT experts are doing their job and protecting critical infrastructure,” he said. “The attack will be repelled and the perpetrators will be tracked down.” 
 
 In a bid to calm public fears about the attack, which temporarily shut down the country’s main airport and prevented travellers from using the Kiev metro, the authorities tweeted a GIF of a dog nonchalantly drinking tea in a room on fire. 
 
 Ukraine / Україна (@Ukraine) Some of our gov agencies, private firms were hit by a virus. No need to panic, we’re putting utmost efforts to tackle the issue 👌 pic.twitter.com/RsDnwZD5Oj 
 
 Deputy prime minister Pavlo Rozenko earlier tweeted a picture of a darkened computer screen and said the government’s IT system had been shut down. The state grid, Ukrenergo, said its system had been hit but power supplies were unaffected. 
 
 The central bank said an “unknown virus” was to blame for the latest attacks. “As a result of these cyber-attacks, these banks are having difficulties with client services and carrying out banking operations,” it said in a statement. 
 
 
 
 Ukraine has blamed Russia for previous cyber-ttacks, including one on its power grid at the end of 2015 that left part of western Ukraine temporarily without electricity. Russia has denied carrying out cyber-attacks on Ukraine. 
 
 
 
 Nicolas Duvinage, head of the French military’s digital crime unit, told Agence France-Presse the attack was “a bit like a flu epidemic in winter”, adding: “We will get many of these viral attack waves in coming months.” 
 
 The growing fight against cyber-attacks has seen protection spending surge around the world, with the global cyber security market estimated to be worth some £94bn ($120bn) this year – more than 30 times its size just over a decade ago. ||||| Image copyright Screenshot Image caption Many reports suggest that screens around the world are getting this message, indicating a ransomware attack is to blame. 
 
 Companies across the globe are reporting that they have been struck by a major ransomware cyber-attack. 
 
 British advertising agency WPP is among those to say its IT systems have been disrupted as a consequence. 
 
 The virus, the source of which is not yet known, freezes the user's computer and demands an untraceable ransom be paid in the digital Bitcoin currency. 
 
 Ukrainian firms, including the state power company and Kiev's main airport, were among the first to report issues. 
 
 The Chernobyl nuclear power plant has also had to monitor radiation levels manually after its Windows-based sensors were shut down. 
 
 Interpol involvement 
 
 In a statement, the US National Security Council said government agencies were investigating the attack and that the US was "determined to hold those responsible accountable". 
 
 The US Department of Homeland Security advised victims not to pay the ransom, saying there was no guarantee that access to files would be restored. 
 
 The Russian anti-virus firm Kaspersky Lab said its analysis showed that there had been about 2,000 attacks - most in Ukraine, Russia and Poland. 
 
 Media playback is unsupported on your device Media caption Technology explained: what is ransomware? 
 
 The international police organisation Interpol has said it was "closely monitoring" the situation and liaising with its member countries. 
 
 Experts suggest the malware is taking advantage of the same weaknesses used by the WannaCry attack last month. 
 
 "It initially appeared to be a variant of a piece of ransomware that emerged last year," said computer scientist Prof Alan Woodward. 
 
 "The ransomware was called Petya and the updated version Petrwrap. 
 
 "However, now that's not so clear." 
 
 Kaspersky Lab reported that it believed the malware was a "new ransomware that has not been seen before" despite its resemblance to Petya. 
 
 As a result, the firm has dubbed it NotPetya. Kaspersky added that it had detected suspected attacks in Poland, Italy, Germany, France and the US in addition to the UK, Russia and Ukraine. 
 
 Andrei Barysevich, a spokesman for security firm Recorded Future, told the BBC such attacks would not stop because cyber-thieves found them too lucrative. 
 
 "A South Korean hosting firm just paid $1m to get their data back and that's a huge incentive," he said. "It's the biggest incentive you could offer to a cyber-criminal." 
 
 A bitcoin wallet associated with the outbreak has received several payments since the outbreak began. The wallet currently holds just over 3.5 bitcoins (£6,775; $8,670). 
 
 An email address associated with the blackmail attempt has been blocked by German independent email provider Posteo. 
 
 It means that the blackmailers have not been able to access the mailbox. 
 
 Problems have also affected: 
 
 the aircraft manufacturer Antonov, and two postal services 
 
 Russia's biggest oil producer, Rosneft 
 
 Danish shipping company Maersk, including its container shipping, oil, gas and drilling operations. A port in Mumbai is among those that has halted operations 
 
 a Pennsylvania hospital operator, Heritage Valley Health System, which reported its computer network was down, causing operations to be delayed - but it is not yet clear if it was subject to the same type of attack 
 
 US food giant Mondelez - whose brands include Oreo and Toblerone. A Cadbury factory in Tasmania, Australia is affected 
 
 Netherlands-based shipping company TNT, which said some of its systems needed "remediation" 
 
 French construction materials company St Gobain 
 
 US pharmaceuticals-maker Merck Sharp & Dohme 
 
 The local offices of the law firm DLA Piper - a sign in the firm's Washington DC office said: "Please remove all laptops from docking stations and keep turned off - no exceptions." 
 
 The attacks come two months after another global ransomware assault, known as WannaCry, which caused major problems for the UK's National Health Service. 
 
 Veteran security expert Chris Wysopal from Veracode said the malware seemed to be spreading via some of the same Windows code loopholes exploited by WannaCry. Many firms did not patch those holes because WannaCry was tackled so quickly, he added. 
 
 Image copyright Twitter/@NCA_UK Image caption The UK's National Crime Agency is investigating the threat 
 
 Those being caught out were also industrial firms that often struggled to apply software patches quickly. 
 
 "These organisations typically have a challenge patching all of their machines because so many systems cannot have down time," he said. "Airports also have this challenge." 
 
 Copies of the virus have been submitted to online testing systems that check if security software, particularly anti-virus systems, were able to spot and stop it. 
 
 "Only two vendors were able to detect it so many systems are defenceless if they are unpatched and relying on anti-virus," he said. 
 
 Image copyright Twitter/@RozenkoPavlo 
 
 Ukraine seems to have been particularly badly hit this time round. 
 
 Reports suggest that the Kiev metro system has stopped accepting payment cards while several chains of petrol stations have suspended operations. 
 
 Ukraine's deputy prime minister has tweeted a picture appearing to show government systems have been affected. 
 
 His caption reads: "Ta-daaa! Network is down at the Cabinet of Minister's secretariat." 
 
 Get news from the BBC in your inbox, each weekday morning ||||| Cybereason security researcher Amit Serper has found a way to prevent the Petya (NotPetya/SortaPetya/Petna) ransomware from infecting computers. 
 
 The ransomware has been wreaking havoc across the globe today, locking hard drive MFT and MBR sections and preventing computers from booting. Unless victims opted to pay a ransom (which is now pointless and not recommended), there was no way to recover their systems. 
 
 In the first hours of the attack, researchers believed this new ransomware was a new version of an older threat called Petya, but they later discovered that this was a new strain altogether, which borrowed some code from Petya, hence the reason why they recently started it calling it NotPetya, Petna, or as we like to call it SortaPetya. 
 
 Researchers flocked to find killswitch mechanism 
 
 Because of the ransomware's global outreach, many researchers flocked to analyze it, hoping to find a loophole in its encryption or a killswitch domain that would stop it from spreading, similar to WannaCry. 
 
 While analyzing the ransomware's inner workings, Serper was the first to discover that NotPetya would search for a local file and would exit its encryption routine if that file already existed on disk. 
 
 The researcher's initial findings have been later confirmed by other security researchers, such as PT Security, TrustedSec, and Emsisoft. 
 
 This means victims can create that file on their PCs, set it to read-only, and block the NotPetya ransomware from executing. 
 
 While this does prevent the ransomware from running, this method is more of a vaccination than a kill switch. This is because each computer user must independently create this file, compared to a "switch" that the ransomware developer could turn on to globally prevent all ransomware infections. 
 
 How to Enable the NotPetya/Petna/Petya Vaccine 
 
 To vaccinate your computer so that you are unable to get infected with the current strain of NotPetya/Petya/Petna (yeah, this naming is annoying), simply create a file called perfc in the C:\Windows folder and make it read only. For those who want a quick and easy way to perform this task, Lawrence Abrams has created a batch file that performs this step for you. 
 
 For those who want a little more control or native executable that can make these changes, I have created a new vaccinator. This is native executable with extra options that may make it easier for those who want to customize which vaccination files are created, to remove vaccination files, and to suppress output for those who wish to use it as part of a login script or another script. The file can be downloaded from here: https://download.bleepingcomputer.com/vaccines/NotPetyaVaccine.exe It is a command line tool that when run without command line arguments will just create the C:\Windows\perfc file and exits. You can use the /h argument to see the full help file that contains info on how to customize its execution.. 
 
 Please note that he batch file will also create two addition vaccination files called perfc.dat and perfc.dll. While my tests did not indicate that these additional files are needed, I added them for thoroughness based on the replies to this tweet. 
 
 This batch file can be found at: https://download.bleepingcomputer.com/bats/nopetyavac.bat 
 
 For those who wish to vaccinate their computer manually, you can do so using the following steps. Please note that these steps are being created to make it as easy as possible for those with little computer experience. For those who have greater experience, you can do it in quite a few, and probably better, ways. 
 
 First, configure Windows to show file extensions. For those who do not know how to do this, you can use this guide. Just make sure the Folder Options setting for Hide extensions for known file types is unchecked like below. 
 
 Once you have enabled the viewing of extensions, which you should always have enabled, open up the C:\Windows folder. Once the folder is open, scroll down till you see the notepad.exe program. 
 
 Once you see the notepad.exe program, left-click on it once so it is highlighted. Then press the Ctrl+C ( ) to copy and then Ctrl+V ( ) to paste it. When you paste it, you will receive a prompt asking you to grant permission to copy the file. 
 
 Press the Continue button and the file will be created as notepad - Copy.exe. Left click on this file and press the F2 key on your keyboard and now erase the notepad - Copy.exe file name and type perfc as shown below. 
 
 Once the filename has been changed to perfc, press Enter on your keyboard. You will now receive a prompt asking if you are sure you wish to rename it. 
 
 Click on the Yes button. Windows will once again ask for permission to rename a file in that folder. Click on the Continue button. 
 
 Now that the perfc file has been created, we now need to make it read only. To do that, right-click on the file and select Properties as shown below. 
 
 The properties menu for this file will now open. At the bottom will be a checkbox labeled Read-only. Put a checkmark in it as shown in the image below. 
 
 Now click on the Apply button and then the OK button. The properties Window should now close. While in my tests, the C:\windows\perfc file is all I needed to vaccinate my computer, it has also been suggested that you create C:\Windows\perfc.dat and C:\Windows\perfc.dll to be thorough. You can redo these steps for those vaccination files as well. 
 
 Your computer should now be vaccinated against the NotPetya/SortaPetya/Petya Ransomware. 
 
 Additional reporting by Lawrence Abrams. 
 
 6/28/17 8:26AM EST: This article has been updated to clarify in more detail how the batch script works 
 
 Bleeping Computer Petya/NotPetya coverage: 
 
 Surprise! NotPetya Is a Cyber-Weapon. It's Not Ransomware 
 
 Petya Ransomware Outbreak Originated in Ukraine via Tainted Accounting Software 
 
 Vaccine, not Killswitch, Found for Petya (NotPetya) Ransomware Outbreak 
 
 Email Provider Shuts Down Petya Inbox Preventing Victims From Recovering Files 
 
 WannaCry Déjà Vu: Petya Ransomware Outbreak Wreaking Havoc Across the Globe ||||| Last month it was the “WannaCry” virus wreaking havoc over the internet, and now this week another ransomware exploit is rapidly expanding across Europe and the Ukraine especially. The new variant, dubbed “Petya,” uses the same SMBv1 exploit that WannaCry uses to rapidly replicate throughout network systems, but holds infected computers hostage in a significantly different way. 
 
 According to a post in Hacker News, the Petya ransomware, also known as “Petwrap,” is spreading rapidly, “shutting down computers at corporates, power supplies, and banks across Russia, Ukraine, Spain, France, UK, India, and Europe and demanding demands $300 in bitcoins,” and has affected over 300,000 computers in only 72 hours. 
 
 Petya does not encrypt files one by one in its attempt to elicit those Bitcoin payments, but uses an even more nefarious method: 
 
 Instead, Petya reboots victims computers and encrypts the hard drive’s master file table (MFT) and rendering the master boot record (MBR) inoperable, restricting access to the full system by seizing information about file names, sizes, and location on the physical disk. Petya replaces the computer’s MBR with its own malicious code that displays the ransom note and leaves computers unable to boot. 
 
 Microsoft issued a series of patches for this type of exploit back in April, including taking the unusual step of patching the unsupported Windows XP operating system, so if you’re current on updates you should be ok. However the company also recommends removing the unused but vulnerable SMBv1 file sharing protocol from your systems. 
 
 It’s pretty easy to do, and well worth it for the peace of mind it could bring as yet another ransomware exploit powered by leaked NSA hacking tools runs amuck. Our colleague over at ZDNet, Ed Bott, runs through the procedure for Windows 10 machines: 
 
 Open the Control Panel (search for it from the Start Menu) 
 
 Click Programs and Features, and then on the left hand column 
 
 Click Turn Windows Features on or off 
 
 Scroll down to SMB 1.0/CIFS File Sharing support, 
 
 Uncheck it, and reboot 
 
 This works for Windows 10 and Windows 8.1, Ed has further instructions if you’re still on Windows 7. As he says, there’s simply no reason for you to be running SMBv1, and Microsoft is planning to remove it entirely in the Windows 10 Fall Creators Update. 
 
 For now, governments and industries are grappling to fight the ransomware and perhaps looking at their penchant for running older unpatched systems, as the dirty tricks of the NSA continue to come back to haunt us. 
 
 Stay safe out there! 
 
 Further reading: Petya ||||| FRANKFURT/MOSCOW/KIEV (Reuters) - A new cyber virus spread from Ukraine to wreak havoc around the globe on Wednesday, crippling thousands of computers, disrupting ports from Mumbai to Los Angeles and halting production at a chocolate factory in Australia. 
 
 The virus is believed to have first taken hold on Tuesday in Ukraine where it silently infected computers after users downloaded a popular tax accounting package or visited a local news site, national police and international cyber experts said. 
 
 More than a day after it first struck, companies around the world were still wrestling with the fallout while cyber security experts scrambled to find a way to stem the spread. 
 
 Danish shipping giant A.P. Moller-Maersk (MAERSKb.CO) said it was struggling to process orders and shift cargoes, congesting some of the 76 ports around the world run by its APM Terminals subsidiary. 
 
 U.S. delivery firm FedEx Corp (FDX.N) said its TNT Express division had been significantly affected by the virus, which also wormed its way into South America, affecting ports in Argentina operated by China’s Cofco. 
 
 The malicious code locked machines and demanded victims post a ransom worth $300 in bitcoins or lose their data entirely, similar to the extortion tactic used in the global WannaCry ransomware attack in May. 
 
 More than 30 victims paid up but security experts are questioning whether extortion was the goal, given the relatively small sum demanded, or whether the hackers were driven by destructive motives rather than financial gain. 
 
 Hackers asked victims to notify them by email when ransoms had been paid but German email provider Posteo quickly shut down the address, a German government cyber security official said. 
 
 Ukraine, the epicenter of the cyber strike, has repeatedly accused Russia of orchestrating attacks on its computer systems and critical power infrastructure since its powerful neighbor annexed the Black Sea peninsula of Crimea in 2014. 
 
 The Kremlin, which has consistently rejected the accusations, said on Wednesday it had no information about the origin of the global cyber attack, which also struck Russian companies such as oil giant Rosneft (ROSN.MM) and a steelmaker. 
 
 “No one can effectively combat cyber threats on their own, and, unfortunately, unfounded blanket accusations will not solve this problem,” said Kremlin spokesman Dmitry Peskov. 
 
 ESET, a Slovakian company that sells products to shield computers from viruses, said 80 percent of the infections detected among its global customer base were in Ukraine, with Italy second hardest hit with about 10 percent. 
 
 ETERNAL BLUE 
 
 The aim of the latest attack appeared to be disruption rather than ransom, said Brian Lord, former deputy director of intelligence and cyber operations at Britain’s GCHQ and now managing director at private security firm PGI Cyber. 
 
 “My sense is this starts to look like a state operating through a proxy ... as a kind of experiment to see what happens,” Lord told Reuters on Wednesday. 
 
 While the malware seemed to be a variant of past campaigns, derived from code known as Eternal Blue believed to have been developed by the U.S. National Security Agency (NSA), experts said it was not as virulent as May’s WannaCry attack. 
 
 Security researchers said Tuesday’s virus could leap from computer to computer once unleashed within an organization but, unlike WannaCry, it could not randomly trawl the internet for its next victims, limiting its scope to infect. 
 
 Bushiness that installed Microsoft’s (MSFT.O) latest security patches from earlier this year and turned off Windows file-sharing features appeared to be largely unaffected. 
 
 There was speculation, however, among some experts that once the new virus had infected one computer it could spread to other machines on the same network, even if those devices had received a security update. 
 
 After WannaCry, governments, security firms and industrial groups advised businesses and consumers to make sure all their computers were updated with Microsoft (MSFT.O) security patches. 
 
 Austria’s government-backed Computer Emergency Response Team (CERT) said “a small number” of international firms appeared to be affected, with tens of thousands of computers taken down. 
 
 Slideshow (12 Images) 
 
 Security firms including Microsoft, Cisco’s (CSCO.O) Talos and Symantec (SYMC.O) said they had confirmed some of the initial infections occurred when malware was transmitted to users of a Ukrainian tax software program called MEDoc. 
 
 The supplier of the software, M.E.Doc denied in a post on Facebook that its software was to blame, though Microsoft reiterated its suspicions afterwards. 
 
 “Microsoft now has evidence that a few active infections of the ransomware initially started from the legitimate MEDoc updater process,” it said in a technical blog post. 
 
 Russian security firm Kaspersky said a Ukrainian news site for the city of Bakhumut was also hacked and used to distribute the ransomware to visitors, encrypting data on their machines. 
 
 CORPORATE CHAOS 
 
 A number of the international firms hit have operations in Ukraine, and the virus is believed to have spread within global corporate networks after gaining traction within the country. 
 
 Shipping giant A.P. Moller-Maersk (MAERSKb.CO), which handles one in seven containers shipped worldwide, has a logistics unit in Ukraine. 
 
 Other large firms affected, such as French construction materials company Saint Gobain (SGOB.PA) and Mondelez International Inc (MDLZ.O), which owns chocolate brand Cadbury, also have operations in the country. 
 
 Maersk was one of the first global firms to be taken down by the cyber attack and its operations at major ports such as Mumbai in India, Rotterdam in the Netherlands and Los Angeles on the U.S. west coast were disrupted. 
 
 Other companies to succumb included BNP Paribas Real Estate (BNPP.PA), a part of the French bank that provides property and investment management services. 
 
 “The international cyber attack hit our non-bank subsidiary, Real Estate. The necessary measures have been taken to rapidly contain the attack,” the bank said on Wednesday. 
 
 Production at the Cadbury factory on the Australian island state of Tasmania ground to a halt late on Tuesday after computer systems went down. 
 
 Russia’s Rosneft, one of the world’s biggest crude producers by volume, said on Tuesday its systems had suffered “serious consequences” but oil production had not been affected because it switched to backup systems.
– Security researchers have been unable to find a "kill switch" for the latest cyberattack hitting systems around the world—but they have developed a vaccine. Researchers say that the Petya ransomware will not encrypt files on computers that have the read-only file "C:\Windows\perfc.dat," the BBC reports. A guide on how to set that up can be found here, though security experts say people running up-to-date versions of Windows will already be protected. And the fix isn't perfect: Researchers warn that although the "vaccination" will make individual computers immune to the attack, the computers could still become "carriers" capable of spreading the malware to others. The cyberattack, which is believed to have originated in a software update for a Ukrainian tax accounting system, spread rapidly around the world Tuesday, with victims including India's largest container port, Russia's biggest oil company, a chocolate factory in Tasmania, and a hospital in Pittsburgh, reports Reuters. The malware encrypted hard drives and demanded $300 in bitcoin to restore files. Around 30 people paid up, though the mailbox involved has now been blocked, Business Insider reports. Analysts tell the Guardian that the low financial return and ineffective payment mechanism suggest that the attack was designed not to make money but to cause chaos in Ukraine, the most affected country.