CLOSE A Microsoft executive has blasted the CIA and NSA for "stockpiling" vulnerabilities in software instead of reporting them to industry so that they can be fixed. Newslook 
 
 Google servers (AP Photo/Google, Connie Zhou) 
 
 SAN FRANCISCO — Microsoft president Brad Smith used Friday's global ransomware attack as a chance to call once more for the nations of the world to create and adhere to a set of Geneva Convention-like rules in cyberspace. 
 
 The massive “WannaCry” malware attack crippled more than 20% of hospitals in the United Kingdom and affected more than 200,000 victims in 150 countries, Rob Wainwright, the head of the European Union’s “Europol” law enforcement agency, said Sunday. 
 
 The software, which spreads among Windows computers, infects and then locks up individual machines, demanding a ransom to be paid in the electronic currency Bitcoin. The attack mostly impacted computers in Europe and Asia and for the most part spared North America. The criminals behind the attack have not yet been identified. 
 
 Smith and others have long advocated that the world’s governments need to pledge not to engage in cyberattacks that target civilian infrastructure. 
 
 The includes not stockpiling flaws in computer code that can be used to craft digital weapons. Just such a stockpiled flaw was behind the rapaciousness and rapidity with which the WannaCry ransomware spread. 
 
 Related stories 
 
 It’s believed a group connected to the National Security Agency, known as The Equation Group, found or purchased previously undiscovered flaws in Microsoft Windows code and used them to create cyber-snooping and infiltration tools. 
 
 Those tools were part of a large cache of older NSA data that was stolen sometime over the past few years. 
 
 In August 2016, a group calling itself The Shadow Brokers began posting materials from that stolen cache of programs online. 
 
 Multiple leaks were posted, including one on April 14 of this year that contained an exploit (flawed computer code that can be used to craft cyberweapons) called EternalBlue. 
 
 That exploit was in turn one of those used to create the WannaCry ransomware program which can rapidly spread itself from computer network to computer network. 
 
 CLOSE It’s being called the biggest ransomware outbreak in history and it could be far from over. Buzz60 
 
 Jonathan Sander, chief technology officer for STEALTHbits Technologies, called WannaCry “a Frankenstein's monster of vulnerabilities with patches and exploits that were stolen from the NSA and published for all to see.” 
 
 The theft and posting of the stolen data gave criminals a huge head start. Instead of having to develop their own arsenals of cyberweapons, they simply had to repurpose work done by the highly skilled cyber experts at the NSA, said Phillip Hallam-Baker, principal scientist at the cybersecurity firm Comodo. 
 
 Just as dangerous as lost nuclear weapons 
 
 The U.S. government clearly had its priorities wrong in not focusing on better protecting these cyberweapons, he said. 
 
 “Whether or not you think the U.S. government should be spending a fortune developing such cyberweapons, surely it is obvious that the weapons they develop should be properly secured. If someone had lost a nuclear weapon, heads would have rolled. The CIA and NSA have been breached on a massive scale, and now the effects are being felt,” Hallam-Baker said. 
 
 Many people in fact believe someone at NSA must have tipped Microsoft that the files had been stolen, which is how it knew it needed to push out that particular patch, said Ryan Kalember of Proofpoint, a Sunnyvale, Calif.-based security firm whose researchers were instrumental in fighting the the WannaCry attack. 
 
 A Microsoft spokesman reached Sunday said the company had no comment. 
 
 Smith wrote in a blog post Sunday that the attack is an excellent object lesson in why governments stockpiling such vulnerabilities is such a problem. 
 
 “This is an emerging pattern in 2017. We have seen vulnerabilities stored by the CIA show up on WikiLeaks, and now this vulnerability stolen from the NSA has affected customers around the world. Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage,” he said. 
 
 Nations need to see the attack as a wake-up call, said Smith. 
 
 “They need to take a different approach and adhere in cyberspace to the same rules applied to weapons in the physical world. We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits.” 
 
 Read or Share this story: https://usat.ly/2qh6H5t ||||| Hospitals, major companies and government offices have been hit by a massive wave of cyberattacks across the globe that seize control of computers until the victims pay a ransom. 
 
 Cybersecurity firm Avast said it had identified more than 75,000 ransomware attacks in 99 countries, making it one of the broadest and most damaging cyberattacks in history. 
 
 Avast said the majority of the attacks targeted Russia, Ukraine and Taiwan. But U.K. hospitals, Chinese universities and global firms like Fedex (FDX) also reported they had come under assault. 
 
 Europol said Saturday that the attack was of an "unprecedented level and requires international investigation." 
 
 The ransomware, called "WannaCry," locks down all the files on an infected computer and asks the computer's administrator to pay in order to regain control of them. The exploit was leaked last month as part of a trove of NSA spy tools. 
 
 The ransomware is spread by taking advantage of a Windows vulnerability that Microsoft (MSFT) released a security patch for in March. But computers and networks that hadn't updated their systems were still at risk. 
 
 In the wake of the attack, Microsoft said it had taken the "highly unusual step" of releasing a patch for computers running older operating systems including Windows XP, Windows 8 and Windows Server 2003. 
 
 "Affected machines have six hours to pay up and every few hours the ransom goes up," said Kurt Baumgartner, the principal security researcher at security firm Kaspersky Lab. "Most folks that have paid up appear to have paid the initial $300 in the first few hours." 
 
 Related: Microsoft quickly fixes 'crazy bad' Windows bug 
 
 Sixteen National Health Service (NHS) organizations in the UK have been hit, and some of those hospitals have canceled outpatient appointments and told people to avoid emergency departments if possible. The NHS said in a statement on Saturday that there was no evidence that patient information had been compromised. 
 
 In China, the internet security company Qihoo360 issued a "red alert" saying that a large number of colleges and students in the country had been affected by the ransomware, which is also referred to as "WannaCrypt." State media reported that digital payment systems at PetroChina gas stations were offline, forcing customers to pay cash. 
 
 "Global internet security has reached a moment of emergency," Qihoo360 warned. 
 
 Spanish telecom company Telefónica (TEF) was also hit with the ransomware. Spanish authorities confirmed the ransomware is spreading through the vulnerability, called "EternalBlue," and advised people to patch. 
 
 "It is going to spread far and wide within the internal systems of organizations -- this is turning into the biggest cybersecurity incident I've ever seen," U.K.-based security architect Kevin Beaumont said. 
 
 Fedex said it was "experiencing interference with some of our Windows-based systems caused by malware" and was trying to fix the problems as quickly as possible. 
 
 Russia's Interior Ministry released a statement acknowledging a ransomware attack on its computers, adding that less than 1% of computers were affected, and that the virus is now "localized." The statement said antivirus systems are working to destroy it. 
 
 Related: NSA's powerful Windows hacking tools leaked online 
 
 Megafon, a Russian telecommunications company, was also hit by the attack. Spokesman Petr Lidov told CNN that it affected call centers but not the company's networks. He said the situation is now under control. 
 
 The U.S. Department of Homeland Security, in a statement late Friday, encouraged people to update their operating systems. "We are actively sharing information related to this event and stand ready to lend technical support and assistance as needed to our partners, both in the United States and internationally," the department said. 
 
 Kaspersky Lab says although the WannaCry ransomware can infect computers even without the vulnerability, EternalBlue is "the most significant factor" in the global outbreak. 
 
 How to prevent it 
 
 Beaumont examined a sample of the ransomware used to target NHS and confirmed it was the same used to target Telefónica. He said companies can apply the patch released in March to all systems to prevent WannaCry infections. Although it won't do any good for machines that have already been hit. 
 
 He said it's likely the ransomware will spread to U.S. firms too. The ransomware is automatically scanning for computers it can infect whenever it loads itself onto a new machine. It can infect other computers on the same wireless network. 
 
 "It has a 'hunter' module, which seeks out PCs on internal networks," Beaumont said. "So, for example, if your laptop is infected and you went to a coffee shop, it would spread to PCs at the coffee shop. From there, to other companies." 
 
 Related: How leaked NSA spy tools created a hacking free-for-all 
 
 According to Matthew Hickey, founder of the security firm Hacker House, Friday's attack is not surprising, and it shows many organizations do not apply updates in a timely fashion. 
 
 When CNNTech first reported the Microsoft vulnerabilities leaked in April, Hickey said they were the "most damaging" he'd seen in several years, and warned that businesses would be most at risk. 
 
 Consumers who have up-to-date software are protected from this ransomware. Here's how to turn automatic updates on. 
 
 It's not the first time hackers have used the leaked NSA tools to infect computers. Soon after the leak, hackers infected thousands of vulnerable machines with a backdoor called DOUBLEPULSAR. 
 
 -- Jethro Mullen, Mariano Castillo, Jessica King, Yuli Yang, Steven Jiang, Clare Sebastian and Livvy Doherty contributed to this report. ||||| Companies have been crippled by global cyberattack, the second major ransomware crime in two months. We answer the key questions 
 
 Many organizations in Europe and the US have been crippled by a ransomware attack known as “Petya”. The malicious software has spread through large firms including the advertiser WPP, food company Mondelez, legal firm DLA Piper and Danish shipping and transport firm Maersk, leading to PCs and data being locked up and held for ransom. 
 
 
 
 It’s the second major global ransomware attack in the past two months. In early May, Britain’s National Health Service (NHS) was among the organizations infected by WannaCry, which used a vulnerability first revealed to the public as part of a leaked stash of NSA-related documents released online in April by a hacker group calling itself the Shadow Brokers. 
 
 NotPetya ransomware attack 'not designed to make money' Read more 
 
 The WannaCry or WannaCrypt ransomware attack affected more than 230,000 computers in over 150 countries, with the NHS, Spanish phone company Telefónica and German state railways among those hardest hit. 
 
 Like WannaCry, “Petya” spreads rapidly through networks that use Microsoft Windows, but what is it, why is it happening and how can it be stopped? 
 
 What is ransomware? 
 
 Ransomware is a type of malware that blocks access to a computer or its data and demands money to release it. 
 
 How does it work? 
 
 When a computer is infected, the ransomware encrypts important documents and files and then demands a ransom, typically in Bitcoin, for a digital key needed to unlock the files. If victims don’t have a recent back-up of the files they must either pay the ransom or face losing all of their files. 
 
 How does the “Petya” ransomware work? 
 
 The ransomware takes over computers and demands $300, paid in Bitcoin. The malicious software spreads rapidly across an organization once a computer is infected using the EternalBlue vulnerability in Microsoft Windows (Microsoft has released a patch, but not everyone will have installed it) or through two Windows administrative tools. The malware tries one option and if it doesn’t work, it tries the next one. “It has a better mechanism for spreading itself than WannaCry,” said Ryan Kalember, of cybersecurity company Proofpoint. 
 
 Is there any protection? 
 
 Most major antivirus companies now claim that their software has updated to actively detect and protect against “Petya” infections: Symantec products using definitions version 20170627.009 should, for instance, and Kaspersky also says its security software is now capable of spotting the malware. Additionally, keeping Windows up to date – at the very least through installing March’s critical patch defending against the EternalBlue vulnerability – stops one major avenue of infection, and will also protect against future attacks with different payloads. 
 
 For this particular malware outbreak, another line of defence has been discovered: “Petya” checks for a read-only file, C:\Windows\perfc.dat, and if it finds it, it won’t run the encryption side of the software. But this “vaccine” doesn’t actually prevent infection, and the malware will still use its foothold on your PC to try to spread to others on the same network. 
 
 Why is it called “Petya”? 
 
 Strictly speaking, it is not. The malware appears to share a significant amount of code with an older piece of ransomware that really was called Petya, but in the hours after the outbreak started, security researchers noticed that “the superficial resemblance is only skin deep”. Researchers at Russia’s Kaspersky Lab redubbed the malware NotPetya, and increasingly tongue-in-cheek variants of that name – Petna, Pneytna, and so on – began to spread as a result. On top of that, other researchers who independently spotted the malware gave it other names: Romanian’s Bitdefender called it Goldeneye, for instance. 
 
 Hackers publish private photos from cosmetic surgery clinic Read more 
 
 Where did it start? 
 
 The attack appears to have been seeded through a software update mechanism built into an accounting program that companies working with the Ukrainian government need to use, according to the Ukrainian cyber police. This explains why so many Ukrainian organizations were affected, including government, banks, state power utilities and Kiev’s airport and metro system. The radiation monitoring system at Chernobyl was also taken offline, forcing employees to use hand-held counters to measure levels at the former nuclear plant’s exclusion zone. A second wave of infections was spawned by a phishing campaign featuring malware-laden attachments. 
 
 How far has it spread? 
 
 The “Petya” ransomware has caused serious disruption at large firms in Europe and the US, including the advertising firm WPP, French construction materials company Saint-Gobain and Russian steel and oil firms Evraz and Rosneft. The food company Mondelez, legal firm DLA Piper, Danish shipping and transport firm AP Moller-Maersk and Heritage Valley Health System, which runs hospitals and care facilities in Pittsburgh, also said their systems had been hit by the malware. 
 
 Crucially, unlike WannaCry, this version of ‘Petya’ tries to spread internally within networks, but not seed itself externally. That may have limited the ultimate spread of the malware, which seems to have seen a decrease in the rate of new infections overnight. 
 
 Facebook Twitter Pinterest Shipping company Maersk’s IT system was impacted by the cyber-attack. Photograph: Mauritz Antin/EPA 
 
 So is this just another opportunistic cybercriminal? 
 
 It initially looked like the outbreak was just another cybercriminal taking advantage of cyberweapons leaked online. However, security experts say that the payment mechanism of the attack seems too amateurish to have been carried out by serious criminals. Firstly, the ransom note includes the same Bitcoin payment address for every victim – most ransomware creates a custom address for every victim. Secondly, the malware asks victims to communicate with the attackers via a single email address which has been suspended by the email provider after they discovered what it was being used for. This means that even if someone pays the ransom, they have no way to communicate with the attacker to request the decryption key to unlock their files. 
 
 UK energy industry cyber-attack fears are 'off the scale' Read more 
 
 Who is behind the attack? 
 
 It is not clear, but it seems likely it is someone who wants the malware to masquerade as ransomware, while actually just being destructive, particularly to the Ukrainian government. Security researcher Nicholas Weaver told cybersecurity blog Krebs on Security that ‘Petya’ was a “deliberate, malicious, destructive attack or perhaps a test disguised as ransomware”. Pseudonymous security researcher Grugq noted that the real Petya “was a criminal enterprise for making money,” but that the new version “is definitely not designed to make money. 
 
 “This is designed to spread fast and cause damage, with a plausibly deniable cover of ‘ransomware,’” he added, pointing out that, among other tells, the payment mechanism in the malware was inept to the point of uselessness: a single hardcoded payment address, meaning the money can be traced; the requirement to email proof of payment to a webmail provider, meaning that the email address can be – and was – disabled; and the requirement to send an infected machine’s 60-character, case sensitive “personal identification key” from a computer which can’t even copy-and-paste, all combine to mean that “this payment pipeline was possibly the worst of all options (sort of ‘send a personal cheque to: Petya Payments, PO Box … ’)”. 
 
 Ukraine has blamed Russia for previous cyber-attacks, including one on its power grid at the end of 2015 that left part of western Ukraine temporarily without electricity. Russia has denied carrying out cyber-attacks on Ukraine. 
 
 What should you do if you are affected by the ransomware? 
 
 The ransomware infects computers and then waits for about an hour before rebooting the machine. While the machine is rebooting, you can switch the computer off to prevent the files from being encrypted and try and rescue the files from the machine, as flagged by @HackerFantastic on Twitter. 
 
 Hacker Fantastic (@hackerfantastic) If machine reboots and you see this message, power off immediately! This is the encryption process. If you do not power on, files are fine. pic.twitter.com/IqwzWdlrX6 
 
 If the system reboots with the ransom note, don’t pay the ransom – the “customer service” email address has been shut down so there’s no way to get the decryption key to unlock your files anyway. Disconnect your PC from the internet, reformat the hard drive and reinstall your files from a backup. Back up your files regularly and keep your anti-virus software up to date. 
 
 This article contains affiliate links, which means we may earn a small commission if a reader clicks through and makes a purchase. All our journalism is independent and is in no way influenced by any advertiser or commercial initiative. 
 
 The links are powered by Skimlinks. By clicking on an affiliate link, you accept that Skimlinks cookies will be set. More information. ||||| Last month it was the “WannaCry” virus wreaking havoc over the internet, and now this week another ransomware exploit is rapidly expanding across Europe and the Ukraine especially. The new variant, dubbed “Petya,” uses the same SMBv1 exploit that WannaCry uses to rapidly replicate throughout network systems, but holds infected computers hostage in a significantly different way. 
 
 According to a post in Hacker News, the Petya ransomware, also known as “Petwrap,” is spreading rapidly, “shutting down computers at corporates, power supplies, and banks across Russia, Ukraine, Spain, France, UK, India, and Europe and demanding demands $300 in bitcoins,” and has affected over 300,000 computers in only 72 hours. 
 
 Petya does not encrypt files one by one in its attempt to elicit those Bitcoin payments, but uses an even more nefarious method: 
 
 Instead, Petya reboots victims computers and encrypts the hard drive’s master file table (MFT) and rendering the master boot record (MBR) inoperable, restricting access to the full system by seizing information about file names, sizes, and location on the physical disk. Petya replaces the computer’s MBR with its own malicious code that displays the ransom note and leaves computers unable to boot. 
 
 Microsoft issued a series of patches for this type of exploit back in April, including taking the unusual step of patching the unsupported Windows XP operating system, so if you’re current on updates you should be ok. However the company also recommends removing the unused but vulnerable SMBv1 file sharing protocol from your systems. 
 
 It’s pretty easy to do, and well worth it for the peace of mind it could bring as yet another ransomware exploit powered by leaked NSA hacking tools runs amuck. Our colleague over at ZDNet, Ed Bott, runs through the procedure for Windows 10 machines: 
 
 Open the Control Panel (search for it from the Start Menu) 
 
 Click Programs and Features, and then on the left hand column 
 
 Click Turn Windows Features on or off 
 
 Scroll down to SMB 1.0/CIFS File Sharing support, 
 
 Uncheck it, and reboot 
 
 This works for Windows 10 and Windows 8.1, Ed has further instructions if you’re still on Windows 7. As he says, there’s simply no reason for you to be running SMBv1, and Microsoft is planning to remove it entirely in the Windows 10 Fall Creators Update. 
 
 For now, governments and industries are grappling to fight the ransomware and perhaps looking at their penchant for running older unpatched systems, as the dirty tricks of the NSA continue to come back to haunt us. 
 
 Stay safe out there! 
 
 Further reading: Petya ||||| Early Friday morning the world experienced the year’s latest cyberattack. 
 
 Starting first in the United Kingdom and Spain, the malicious “WannaCrypt” software quickly spread globally, blocking customers from their data unless they paid a ransom using Bitcoin. The WannaCrypt exploits used in the attack were drawn from the exploits stolen from the National Security Agency, or NSA, in the United States. That theft was publicly reported earlier this year. A month prior, on March 14, Microsoft had released a security update to patch this vulnerability and protect our customers. While this protected newer Windows systems and computers that had enabled Windows Update to apply this latest update, many computers remained unpatched globally. As a result, hospitals, businesses, governments, and computers at homes were affected. 
 
 All of this provides the broadest example yet of so-called “ransomware,” which is only one type of cyberattack. Unfortunately, consumers and business leaders have become familiar with terms like “zero day” and “phishing” that are part of the broad array of tools used to attack individuals and infrastructure. We take every single cyberattack on a Windows system seriously, and we’ve been working around the clock since Friday to help all our customers who have been affected by this incident. This included a decision to take additional steps to assist users with older systems that are no longer supported. Clearly, responding to this attack and helping those affected needs to be our most immediate priority. 
 
 At the same time, it’s already apparent that there will be broader and important lessons from the “WannaCrypt” attack we’ll need to consider to avoid these types of attacks in the future. I see three areas where this event provides an opportunity for Microsoft and the industry to improve. 
 
 As a technology company, we at Microsoft have the first responsibility to address these issues. We increasingly are among the first responders to attacks on the internet. We have more than 3,500 security engineers at the company, and we’re working comprehensively to address cybersecurity threats. This includes new security functionality across our entire software platform, including constant updates to our Advanced Threat Protection service to detect and disrupt new cyberattacks. In this instance, this included the development and release of the patch in March, a prompt update on Friday to Windows Defender to detect the WannaCrypt attack, and work by our customer support personnel to help customers afflicted by the attack. 
 
 But as this attack demonstrates, there is no cause for celebration. We’ll assess this attack, ask what lessons we can learn, and apply these to strengthen our capabilities. Working through our Microsoft Threat Intelligence Center (MSTIC) and Digital Crimes Unit, we’ll also share what we learn with law enforcement agencies, governments, and other customers around the world. 
 
 Second, this attack demonstrates the degree to which cybersecurity has become a shared responsibility between tech companies and customers. The fact that so many computers remained vulnerable two months after the release of a patch illustrates this aspect. As cybercriminals become more sophisticated, there is simply no way for customers to protect themselves against threats unless they update their systems. Otherwise they’re literally fighting the problems of the present with tools from the past. This attack is a powerful reminder that information technology basics like keeping computers current and patched are a high responsibility for everyone, and it’s something every top executive should support. 
 
 At the same time, we have a clear understanding of the complexity and diversity of today’s IT infrastructure, and how updates can be a formidable practical challenge for many customers. Today, we use robust testing and analytics to enable rapid updates into IT infrastructure, and we are dedicated to developing further steps to help ensure security updates are applied immediately to all IT environments. 
 
 Finally, this attack provides yet another example of why the stockpiling of vulnerabilities by governments is such a problem. This is an emerging pattern in 2017. We have seen vulnerabilities stored by the CIA show up on WikiLeaks, and now this vulnerability stolen from the NSA has affected customers around the world. Repeatedly, exploits in the hands of governments have leaked into the public domain and caused widespread damage. An equivalent scenario with conventional weapons would be the U.S. military having some of its Tomahawk missiles stolen. And this most recent attack represents a completely unintended but disconcerting link between the two most serious forms of cybersecurity threats in the world today – nation-state action and organized criminal action. 
 
 The governments of the world should treat this attack as a wake-up call. They need to take a different approach and adhere in cyberspace to the same rules applied to weapons in the physical world. We need governments to consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits. This is one reason we called in February for a new “Digital Geneva Convention” to govern these issues, including a new requirement for governments to report vulnerabilities to vendors, rather than stockpile, sell, or exploit them. And it’s why we’ve pledged our support for defending every customer everywhere in the face of cyberattacks, regardless of their nationality. This weekend, whether it’s in London, New York, Moscow, Delhi, Sao Paulo, or Beijing, we’re putting this principle into action and working with customers around the world. 
 
 We should take from this recent attack a renewed determination for more urgent collective action. We need the tech sector, customers, and governments to work together to protect against cybersecurity attacks. More action is needed, and it’s needed now. In this sense, the WannaCrypt attack is a wake-up call for all of us. We recognize our responsibility to help answer this call, and Microsoft is committed to doing its part. ||||| WASHINGTON (Reuters) - Governments turned their attention to a possible new wave of cyber threats on Tuesday after the group that leaked U.S. hacking tools used to launch the global WannaCry “ransomware” attack warned it would release more malicious code. 
 
 The fast-spreading cyber extortion campaign, which has infected more than 300,000 computers worldwide since Friday, eased for second day on Tuesday, but the identity and motive of its creators remain unknown. 
 
 The attack includes elements that belong to the U.S. National Security Agency and were leaked online last month. 
 
 Shadow Brokers, the group that has taken credit for that leak, threatened on Tuesday to release more recent code to enable hackers to break into the world’s most widely used computers, software and phones. 
 
 A blog post written by the group promised from June to release tools every month to anyone willing to pay for access to some of the tech world’s biggest commercial secrets. 
 
 It also threatened to dump data from banks using the SWIFT international money transfer network and from Russian, Chinese, Iranian or North Korean nuclear and missile programs. “More details in June,” it promised. 
 
 The spread of the WannaCry attack - which encrypts a user’s data and demands a “ransom” be paid electronically to free it up again - slowed to a trickle on Tuesday, with few, isolated examples being reported. 
 
 In Canada, the Universite de Montreal was hit, with 120 of the French-language university’s 8,300 computers affected, according to a university spokeswoman. 
 
 There were no new, major incidents in the United States. Fewer than 10 U.S. organizations have reported attacks to the Department of Homeland Security since Friday, a U.S. official told reporters on Tuesday. 
 
 The attack has caused most damage in Russia, Taiwan, Ukraine and India, according to Czech security firm Avast. 
 
 The United States likely avoided greater harm as the attack targeted older versions of Microsoft Corp’s (MSFT.O) Windows operating system, and more U.S. users have licensed, up-to-date, patched versions of the software, compared to other regions of the world. 
 
 The Department of Homeland Security began an “aggressive awareness campaign” to alert the tech industry to the importance of installing the patch that Microsoft issued in March that protected users from the vulnerability exploited by the attack, a U.S. official working on the attack told Reuters. 
 
 Microsoft said on Tuesday it was aware of Shadow Brokers’ most recent claim and that its security teams monitor potential threats in order to “help us prioritize and take appropriate action.” 
 
 Microsoft President and Chief Legal Officer Brad Smith said earlier this week the WannaCry attack used elements stolen from the NSA. The U.S. government has not commented directly on the matter. 
 
 A screenshot shows a WannaCry ransomware demand, provided by cyber security firm Symantec, in Mountain View, California, U.S. May 15, 2017. Courtesy of Symantec/Handout via REUTERS 
 
 NORTH KOREA LINK PROBED 
 
 Cyber security researchers around the world have said they have found evidence that could link North Korea with the WannaCry cyber attack. 
 
 A researcher from South Korea’s Hauri Labs said on Tuesday their own findings matched those of Symantec (SYMC.O) and Kaspersky Lab, who said on Monday that some code in an earlier version of the WannaCry software had also appeared in programs used by the Lazarus Group, identified by some researchers as a North Korea-run hacking operation. 
 
 “It is similar to North Korea’s backdoor malicious codes,” said Simon Choi, a senior researcher with Hauri who has done extensive research into North Korea’s hacking capabilities and advises South Korean police and National Intelligence Service. 
 
 Both Symantec and Kaspersky said it was too early to tell whether North Korea was involved in the attacks, based on the evidence that was published on Twitter by Google security researcher Neel Mehta. 
 
 FireEye Inc (FEYE.O), another large cyber security firm, said it was also investigating, but it was cautious about drawing a link to North Korea. 
 
 “The similarities we see between malware linked to that group and WannaCry are not unique enough to be strongly suggestive of a common operator,” FireEye researcher John Miller said. 
 
 U.S. and European security officials told Reuters on condition of anonymity that it was too early to say who might be behind the attacks, but they did not rule out North Korea as a suspect. 
 
 Slideshow (19 Images) 
 
 The Lazarus hackers, acting for impoverished North Korea, have been more brazen in their pursuit of financial gain than others, and have been blamed for the theft of $81 million from the Bangladesh central bank, according to some cyber security firms. The United States accused it of being behind a cyber attack on Sony Pictures in 2014. 
 
 North Korea has denied being behind the Sony and banking attacks. North Korean officials were not immediately available for comment and its state media has been quiet about the matter. 
 
 NO INFORMATION TO SHARE 
 
 In China, foreign ministry spokeswoman Hua Chunying said she had no information to share, when asked about the origin of the attack and whether North Korea might be connected. 
 
 Several Asian countries have been affected by the malware, although the impact has not been as widespread as some had feared. 
 
 In Malaysia, cyber security firm LE Global Services said it identified 12 cases so far, including a large government-linked corporation, a government-linked investment firm and an insurance company. It did not name any of the entities. 
 
 “We may not see the real picture yet, as companies are not mandated to disclose security breaches to authorities in Malaysia,” said LE Global CEO Fong Choong Fook. 
 
 “The real situation may be serious. In one of the cases, the attack was traced back to early April.” 
 
 Vietnam’s state media said on Tuesday more than 200 computers had been affected, but one of the country’s leading anti virus companies, Bkav, later put the figure at 1,900. 
 
 Taiwan Power Co. TAIWP.UL said that nearly 800 of its computers were affected, although these were used for administration, not for systems involved in electricity generation.
– As experts scramble to make heads or tails over WannaCry, a global cyberattack unleashed Friday that’s affected up to 200,000 computers in 150 countries, some fear the worst is yet to come. According to the Wall Street Journal, the spread of attacks has slowed down after a kill switch was activated by a stroke of luck, but even more computers may find the ransomware waiting for them when they log back into their systems after the weekend break. Here’s the latest on WannaCry: A primer: CNN’s breakdown and timeline of the WannaCry attack, which some are calling the largest cyberattack ever executed, will catch you up to speed on what happened. The attack exploits a vulnerability in Microsoft Windows. About ransomware: The anonymous attack comes in the form of ransomware, a type of malware that locks a computer’s files, making it impossible to access them. On the locked screen, users are instructed to pay up a sum within a time frame—in this case $300 to a Bitcoin account within three days. Tech blogger and expert Troy Hunt explains more in detail. Windows users: If you're using Windows XP, upgrade quickly, advises a Q&A in the Irish Times. If you're already infected, the fix isn't easy, but Microsoft has the particulars. Are Macs safer? In this case, yes. WannaCry affects Windows systems, but not Macs. Apple computers tend to field less attacks, but according to the International Business Times, it’s not because Mac security is impenetrable. Since PCs are more widespread, more viruses are written for them. Shoring up your digital security: The New York Times outlines eight general steps that can help your digital thumbprint from mobile to desktop, like using apps such as Signal or WhatsApp when texting. NSA's role: Some of the key code utilized may have been created by the NSA, reports the BBC. It raises the question of whether government agencies should disclose the vulnerabilities they've discovered. Edward Snowden concurs: "In light of today's attack, Congress needs to be asking @NSAgov if it knows of any other vulnerabilities in software used in our hospitals," he wrote on Twitter. Bitcoin in spotlight: Bitcoin, the anonymous digital currency, saw a drop in value on Friday from $1,800 to $1,600, according to CryptoCoin News, before it stabilized to $1,700 Saturday. Some experts think hackers might be trying to manipulate the currency to boost profits. The site looks at how the attack could affect the currency, for better or worse. Microsoft has offered to provide extended support to all users, even those with the most ancient operating systems.