CLOSE A Microsoft executive has blasted the CIA and NSA for "stockpiling" vulnerabilities in software instead of reporting them to industry so that they can be fixed. Newslook 
 
 Google servers (AP Photo/Google, Connie Zhou) 
 
 SAN FRANCISCO — Microsoft president Brad Smith used Friday's global ransomware attack as a chance to call once more for the nations of the world to create and adhere to a set of Geneva Convention-like rules in cyberspace. 
 
 The massive “WannaCry” malware attack crippled more than 20% of hospitals in the United Kingdom and affected more than 200,000 victims in 150 countries, Rob Wainwright, the head of the European Union’s “Europol” law enforcement agency, said Sunday. 
 
 The software, which spreads among Windows computers, infects and then locks up individual machines, demanding a ransom to be paid in the electronic currency Bitcoin. The attack mostly impacted computers in Europe and Asia and for the most part spared North America. The criminals behind the attack have not yet been identified. 
 
 Smith and others have long advocated that the world’s governments need to pledge not to engage in cyberattacks that target civilian infrastructure. 
 
 The includes not stockpiling flaws in computer code that can be used to craft digital weapons. Just such a stockpiled flaw was behind the rapaciousness and rapidity with which the WannaCry ransomware spread. 
 
 Related stories 
 
 It’s believed a group connected to the National Security Agency, known as The Equation Group, found or purchased previously undiscovered flaws in Microsoft Windows code and used them to create cyber-snooping and infiltration tools. 
 
 Those tools were part of a large cache of older NSA data that was stolen sometime over the past few years. 
 
 In August 2016, a group calling itself The Shadow Brokers began posting materials from that stolen cache of programs online. 
 
 Multiple leaks were posted, including one on April 14 of this year that contained an exploit (flawed computer code that can be used to craft cyberweapons) called EternalBlue. 
 
 That exploit was in turn one of those used to create the WannaCry ransomware program which can rapidly spread itself from computer network to computer network. 
 
 CLOSE It’s being called the biggest ransomware outbreak in history and it could be far from over. Buzz60 
 
 Jonathan Sander, chief technology officer for STEALTHbits Technologies, called WannaCry “a Frankenstein's monster of vulnerabilities with patches and exploits that were stolen from the NSA and published for all to see.” 
 
 The theft and posting of the stolen data gave criminals a huge head start. Instead of having to develop their own arsenals of cyberweapons, they simply had to repurpose work done by the highly skilled cyber experts at the NSA, said Phillip Hallam-Baker, principal scientist at the cybersecurity firm Comodo. 
 
 Just as dangerous as lost nuclear weapons 
 
 The U.S. government clearly had its priorities wrong in not focusing on better protecting these cyberweapons, he said. 
 
 “Whether or not you think the U.S. government should be spending a fortune developing such cyberweapons, surely it is obvious that the weapons they develop should be properly secured. If someone had lost a nuclear weapon, heads would have rolled. The CIA and NSA have been breached on a massive scale, and now the effects are being felt,” Hallam-Baker said. 
 
 Many people in fact believe someone at NSA must have tipped Microsoft that the files had been stolen, which is how it knew it needed to push out that particular patch, said Ryan Kalember of Proofpoint, a Sunnyvale, Calif.-based security firm whose researchers were instrumental in fighting the the WannaCry attack. 
 
 A Microsoft spokesman reached Sunday said the company had no comment. 
 
 Smith wrote in a blog post Sunday that the attack is an excellent object lesson in why governments stockpiling such vulnerabilities is such a problem. 
 
 “This is an emerging pattern in 2017. We have seen vulnerabilities stored by the CIA show up on WikiLeaks, and now this vulnerability stolen from the NSA has affected customers around the world. Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage,” he said. 
 
 Nations need to see the attack as a wake-up call, said Smith. 
 
 “They need to take a different approach and adhere in cyberspace to the same rules applied to weapons in the physical world. We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits.” 
 
 Read or Share this story: https://usat.ly/2qh6H5t ||||| Hospitals, major companies and government offices have been hit by a massive wave of cyberattacks across the globe that seize control of computers until the victims pay a ransom. 
 
 Cybersecurity firm Avast said it had identified more than 75,000 ransomware attacks in 99 countries, making it one of the broadest and most damaging cyberattacks in history. 
 
 Avast said the majority of the attacks targeted Russia, Ukraine and Taiwan. But U.K. hospitals, Chinese universities and global firms like Fedex (FDX) also reported they had come under assault. 
 
 Europol said Saturday that the attack was of an "unprecedented level and requires international investigation." 
 
 The ransomware, called "WannaCry," locks down all the files on an infected computer and asks the computer's administrator to pay in order to regain control of them. The exploit was leaked last month as part of a trove of NSA spy tools. 
 
 The ransomware is spread by taking advantage of a Windows vulnerability that Microsoft (MSFT) released a security patch for in March. But computers and networks that hadn't updated their systems were still at risk. 
 
 In the wake of the attack, Microsoft said it had taken the "highly unusual step" of releasing a patch for computers running older operating systems including Windows XP, Windows 8 and Windows Server 2003. 
 
 "Affected machines have six hours to pay up and every few hours the ransom goes up," said Kurt Baumgartner, the principal security researcher at security firm Kaspersky Lab. "Most folks that have paid up appear to have paid the initial $300 in the first few hours." 
 
 Related: Microsoft quickly fixes 'crazy bad' Windows bug 
 
 Sixteen National Health Service (NHS) organizations in the UK have been hit, and some of those hospitals have canceled outpatient appointments and told people to avoid emergency departments if possible. The NHS said in a statement on Saturday that there was no evidence that patient information had been compromised. 
 
 In China, the internet security company Qihoo360 issued a "red alert" saying that a large number of colleges and students in the country had been affected by the ransomware, which is also referred to as "WannaCrypt." State media reported that digital payment systems at PetroChina gas stations were offline, forcing customers to pay cash. 
 
 "Global internet security has reached a moment of emergency," Qihoo360 warned. 
 
 Spanish telecom company Telefónica (TEF) was also hit with the ransomware. Spanish authorities confirmed the ransomware is spreading through the vulnerability, called "EternalBlue," and advised people to patch. 
 
 "It is going to spread far and wide within the internal systems of organizations -- this is turning into the biggest cybersecurity incident I've ever seen," U.K.-based security architect Kevin Beaumont said. 
 
 Fedex said it was "experiencing interference with some of our Windows-based systems caused by malware" and was trying to fix the problems as quickly as possible. 
 
 Russia's Interior Ministry released a statement acknowledging a ransomware attack on its computers, adding that less than 1% of computers were affected, and that the virus is now "localized." The statement said antivirus systems are working to destroy it. 
 
 Related: NSA's powerful Windows hacking tools leaked online 
 
 Megafon, a Russian telecommunications company, was also hit by the attack. Spokesman Petr Lidov told CNN that it affected call centers but not the company's networks. He said the situation is now under control. 
 
 The U.S. Department of Homeland Security, in a statement late Friday, encouraged people to update their operating systems. "We are actively sharing information related to this event and stand ready to lend technical support and assistance as needed to our partners, both in the United States and internationally," the department said. 
 
 Kaspersky Lab says although the WannaCry ransomware can infect computers even without the vulnerability, EternalBlue is "the most significant factor" in the global outbreak. 
 
 How to prevent it 
 
 Beaumont examined a sample of the ransomware used to target NHS and confirmed it was the same used to target Telefónica. He said companies can apply the patch released in March to all systems to prevent WannaCry infections. Although it won't do any good for machines that have already been hit. 
 
 He said it's likely the ransomware will spread to U.S. firms too. The ransomware is automatically scanning for computers it can infect whenever it loads itself onto a new machine. It can infect other computers on the same wireless network. 
 
 "It has a 'hunter' module, which seeks out PCs on internal networks," Beaumont said. "So, for example, if your laptop is infected and you went to a coffee shop, it would spread to PCs at the coffee shop. From there, to other companies." 
 
 Related: How leaked NSA spy tools created a hacking free-for-all 
 
 According to Matthew Hickey, founder of the security firm Hacker House, Friday's attack is not surprising, and it shows many organizations do not apply updates in a timely fashion. 
 
 When CNNTech first reported the Microsoft vulnerabilities leaked in April, Hickey said they were the "most damaging" he'd seen in several years, and warned that businesses would be most at risk. 
 
 Consumers who have up-to-date software are protected from this ransomware. Here's how to turn automatic updates on. 
 
 It's not the first time hackers have used the leaked NSA tools to infect computers. Soon after the leak, hackers infected thousands of vulnerable machines with a backdoor called DOUBLEPULSAR. 
 
 -- Jethro Mullen, Mariano Castillo, Jessica King, Yuli Yang, Steven Jiang, Clare Sebastian and Livvy Doherty contributed to this report. ||||| WASHINGTON (Reuters) - Governments turned their attention to a possible new wave of cyber threats on Tuesday after the group that leaked U.S. hacking tools used to launch the global WannaCry “ransomware” attack warned it would release more malicious code. 
 
 The fast-spreading cyber extortion campaign, which has infected more than 300,000 computers worldwide since Friday, eased for second day on Tuesday, but the identity and motive of its creators remain unknown. 
 
 The attack includes elements that belong to the U.S. National Security Agency and were leaked online last month. 
 
 Shadow Brokers, the group that has taken credit for that leak, threatened on Tuesday to release more recent code to enable hackers to break into the world’s most widely used computers, software and phones. 
 
 A blog post written by the group promised from June to release tools every month to anyone willing to pay for access to some of the tech world’s biggest commercial secrets. 
 
 It also threatened to dump data from banks using the SWIFT international money transfer network and from Russian, Chinese, Iranian or North Korean nuclear and missile programs. “More details in June,” it promised. 
 
 The spread of the WannaCry attack - which encrypts a user’s data and demands a “ransom” be paid electronically to free it up again - slowed to a trickle on Tuesday, with few, isolated examples being reported. 
 
 In Canada, the Universite de Montreal was hit, with 120 of the French-language university’s 8,300 computers affected, according to a university spokeswoman. 
 
 There were no new, major incidents in the United States. Fewer than 10 U.S. organizations have reported attacks to the Department of Homeland Security since Friday, a U.S. official told reporters on Tuesday. 
 
 The attack has caused most damage in Russia, Taiwan, Ukraine and India, according to Czech security firm Avast. 
 
 The United States likely avoided greater harm as the attack targeted older versions of Microsoft Corp’s (MSFT.O) Windows operating system, and more U.S. users have licensed, up-to-date, patched versions of the software, compared to other regions of the world. 
 
 The Department of Homeland Security began an “aggressive awareness campaign” to alert the tech industry to the importance of installing the patch that Microsoft issued in March that protected users from the vulnerability exploited by the attack, a U.S. official working on the attack told Reuters. 
 
 Microsoft said on Tuesday it was aware of Shadow Brokers’ most recent claim and that its security teams monitor potential threats in order to “help us prioritize and take appropriate action.” 
 
 Microsoft President and Chief Legal Officer Brad Smith said earlier this week the WannaCry attack used elements stolen from the NSA. The U.S. government has not commented directly on the matter. 
 
 A screenshot shows a WannaCry ransomware demand, provided by cyber security firm Symantec, in Mountain View, California, U.S. May 15, 2017. Courtesy of Symantec/Handout via REUTERS 
 
 NORTH KOREA LINK PROBED 
 
 Cyber security researchers around the world have said they have found evidence that could link North Korea with the WannaCry cyber attack. 
 
 A researcher from South Korea’s Hauri Labs said on Tuesday their own findings matched those of Symantec (SYMC.O) and Kaspersky Lab, who said on Monday that some code in an earlier version of the WannaCry software had also appeared in programs used by the Lazarus Group, identified by some researchers as a North Korea-run hacking operation. 
 
 “It is similar to North Korea’s backdoor malicious codes,” said Simon Choi, a senior researcher with Hauri who has done extensive research into North Korea’s hacking capabilities and advises South Korean police and National Intelligence Service. 
 
 Both Symantec and Kaspersky said it was too early to tell whether North Korea was involved in the attacks, based on the evidence that was published on Twitter by Google security researcher Neel Mehta. 
 
 FireEye Inc (FEYE.O), another large cyber security firm, said it was also investigating, but it was cautious about drawing a link to North Korea. 
 
 “The similarities we see between malware linked to that group and WannaCry are not unique enough to be strongly suggestive of a common operator,” FireEye researcher John Miller said. 
 
 U.S. and European security officials told Reuters on condition of anonymity that it was too early to say who might be behind the attacks, but they did not rule out North Korea as a suspect. 
 
 Slideshow (19 Images) 
 
 The Lazarus hackers, acting for impoverished North Korea, have been more brazen in their pursuit of financial gain than others, and have been blamed for the theft of $81 million from the Bangladesh central bank, according to some cyber security firms. The United States accused it of being behind a cyber attack on Sony Pictures in 2014. 
 
 North Korea has denied being behind the Sony and banking attacks. North Korean officials were not immediately available for comment and its state media has been quiet about the matter. 
 
 NO INFORMATION TO SHARE 
 
 In China, foreign ministry spokeswoman Hua Chunying said she had no information to share, when asked about the origin of the attack and whether North Korea might be connected. 
 
 Several Asian countries have been affected by the malware, although the impact has not been as widespread as some had feared. 
 
 In Malaysia, cyber security firm LE Global Services said it identified 12 cases so far, including a large government-linked corporation, a government-linked investment firm and an insurance company. It did not name any of the entities. 
 
 “We may not see the real picture yet, as companies are not mandated to disclose security breaches to authorities in Malaysia,” said LE Global CEO Fong Choong Fook. 
 
 “The real situation may be serious. In one of the cases, the attack was traced back to early April.” 
 
 Vietnam’s state media said on Tuesday more than 200 computers had been affected, but one of the country’s leading anti virus companies, Bkav, later put the figure at 1,900. 
 
 Taiwan Power Co. TAIWP.UL said that nearly 800 of its computers were affected, although these were used for administration, not for systems involved in electricity generation. ||||| Media playback is unsupported on your device Media caption How to protect yourself online from a cyber-attack 
 
 A computer malware that has spread across 150 countries appears to be slowing down, with few reports of fresh attacks globally on Monday. 
 
 A spokesperson for police agency Europol said the situation in Europe "seems stable". 
 
 In Asia, where many offices closed before the WannaCry ransomware struck on Friday, the attack has been less severe than expected. 
 
 The ransomware takes over users' files, demanding $300 (£230) to restore them. 
 
 The White House said on Monday that under $70,000 (£54,000) had been paid in total in a bid to get any locked data released. 
 
 Payments could go up as the ransomware warned the cost would double after three days, and threatened to delete files within seven days if no payment was made. 
 
 Computer giant Microsoft said the attack, which has affected hundreds of thousands of computers, should serve as a wake-up call. 
 
 Among the organisations targeted worldwide have been Germany's rail network Deutsche Bahn, Spanish telecommunications operator Telefonica, US logistics giant FedEx and Russia's interior ministry. 
 
 What was the situation on Monday? 
 
 Many firms employed experts over the weekend to try to prevent new infections. 
 
 Senior spokesman for Europol, Jan Op Gen Oorth, told the AFP news agency: "The number of victims appears not to have gone up and so far the situation seems stable in Europe, which is a success. 
 
 "It seems that a lot of internet security guys over the weekend did their homework and ran the security software updates." 
 
 UK Health Minister Jeremy Hunt confirmed to the BBC that UK intelligence services had found no evidence of a second wave of attacks on Monday. 
 
 The badly affected National Health Service said seven out of 47 trusts that were hit were still facing serious issues. 
 
 French carmaker Renault said its plant in the northern town of Douai would not reopen on Monday as it dealt with the cyber-attack. 
 
 In Asia, the spread was reportedly slowing, with banking systems largely unaffected: 
 
 Australia : At least eight businesses reported being locked out of their systems 
 
 : At least eight businesses reported being locked out of their systems South Korea : Four companies reported problems over the weekend. One cinema chain was unable to display trailers 
 
 : Four companies reported problems over the weekend. One cinema chain was unable to display trailers Indonesia : Records at two hospitals were blocked 
 
 : Records at two hospitals were blocked Japan : Both Nissan and Hitachi reported some units had been affected, but not seriously 
 
 : Both Nissan and Hitachi reported some units had been affected, but not seriously China: Computers at nearly 30,000 institutions and organisations were affected, including government agencies and hospitals, internet firm Qihoo 360 said. Some payment systems and government services affected, but less than feared 
 
 US President Donald Trump's Homeland Security adviser Tom Bossert has also confirmed that no US federal government systems were affected. 
 
 Who is behind the attack? 
 
 This won't take long. Nobody knows. Europol's Jan Op Gen Oorth said: "A bit early to say... but we are working on a decrypting tool". 
 
 Associated Press quoted Tim Wellsmore, of US security firm FireEye, as saying: "We expect this is a small operation... They just happened to hit the mother lode." 
 
 Russian President Vladimir Putin said: "Russia has absolutely nothing to do with it." 
 
 EU Commissioner for Security Julian King told the BBC on Monday that the EU was proposing legislation to reinforce cyber security in the wake of the attack. 
 
 Some private sector security researchers say they have seen some similarities between some of the code in the recent attack and some linked to North Korea in the past. 
 
 Security officials in the UK, however, say they have not seen anything they would regard as hard evidence, Gordon Corera, the BBC's security correspondent, reports. 
 
 Should people pay? 
 
 Companies in Asia and Europe have been warning employees to be careful when clicking on attachments and links in their emails. 
 
 The message from the UK's National Crime Agency was "do not pay!" - there is no guarantee that systems will be restored. 
 
 Michael Gazeley, of Network Box, a Hong Kong-based cyber-security firm, told Reuters there were still "many 'landmines' waiting in people's inboxes", adding that his firm had detected a new version that infected users directly via a malicious link on hacked websites. 
 
 Media playback is unsupported on your device Media caption Technology explained: what is ransomware? 
 
 Becky Pinkard, from Digital Shadows, a UK-based cyber-security firm, also said it would be easy for the initial attackers or "copy-cat authors" to change the virus code so it is difficult to guard against. 
 
 A UK security researcher known as "MalwareTech", who helped to limit the ransomware attack, had predicted "another one coming... quite likely on Monday". 
 
 MalwareTech, whose name was revealed in UK media to be 22-year-old Marcus Hutchins, was hailed as an "accidental hero" after registering a domain name to track the spread of the virus, which actually ended up halting it. 
 
 What's behind Microsoft's 'wake-up call' warning? 
 
 The computing giant says the tool used in this current attack had been developed by the US National Security Agency and was stolen by hackers. 
 
 It is highly critical of the way governments store data on software vulnerabilities. 
 
 Image copyright AFP Image caption A railway station system in Chemnitz, eastern Germany, is infected 
 
 Microsoft president and chief legal officer Brad Smith said on Sunday: "We have seen vulnerabilities stored by the CIA show up on Wikileaks, and now this vulnerability stolen from the NSA has affected customers around the world. 
 
 "An equivalent scenario with conventional weapons would be the US military having some of its Tomahawk missiles stolen." 
 
 The organisation also said that many organisations had failed to keep their systems up to date, allowing the virus to spread. 
 
 Microsoft said it had released a Windows security update in March to tackle the problem involved in the latest attack, but many users were yet to run it. 
 
 How roots can be traced to the US 
 
 Get news from the BBC in your inbox, each weekday morning
– The massive ransomware attack still reverberating around the world is the kind of thing that is going to keep happening unless rules like those governing conventional warfare are brought in for cyberspace, Microsoft says. Microsoft president Brad Smith warned in a blog post Sunday that the "stockpiling of vulnerabilities by governments" has once again caused enormous damage, USA Today reports. Smith says the "WannaCrypt" attack, also known as "WannaCry," was created with data stolen from the NSA, which had used a vulnerability it found to create cyberweapons. The equivalent scenario with conventional weapons would be the "US military having some of its Tomahawk missiles stolen," Smith said. "The governments of the world should treat this attack as a wake-up call," Smith wrote, repeating the company's call for a digital Geneva Convention. Microsoft issued a patch after the theft was discovered in March, but it was not issued to people and organizations using older versions of its system. More than 200,000 computers in 150 countries have been affected and the AP reports that there were thousands more cases early Monday as people got back to work after the weekend and booted up infected computers. The ransomware is demanding $300 to unlock user's files. The BBC says its analysis of accounts linked to the attack found that around $38,000 had been paid by early Monday.