iStock/Thinkstock(NEW YORK) — Europe and Russia were left reeling Saturday by a malicious global cyberattack that used leaked NSA tools to exploit a vulnerability in Microsoft Windows and spread ransomware across networks around the world.

Tens of thousands of users from London to St. Petersburg logged on yesterday to find ominous threats to delete their suddenly encrypted computer files, unless they cough up $300 or more in Bitcoin payments to the unknown perpetrators, security experts and intelligence officials told ABC News Saturday.

A message saying “Oops, your important files are encrypted” flashed across screens all over the world. According to The New York Times, experts estimated that before the last affected computers are unlocked, victims could collectively pay more than $1 billion to the attackers.

The attack appears to have been thwarted by private cybersecurity researchers who identified and triggered the malware’s “kill switch,” which halted the attacks before it spread throughout U.S. networks, a senior U.S. intelligence official confirmed, but it is unclear whether, the official said, a modified attack will soon be launched.

“That is a huge concern right now,” said Darien Huss, a senior security research engineer at Proofpoint who was among the researchers who helped disable the virus, called “WannaCry,” told ABC News Saturday. “It would not be very difficult at all to re-release this ransomware attack without a kill switch or without an approved kill switch that only they can activate.”

Huss is also worried about copycats, who could “take the exploit code that was used in this attack and implement it into their own virus.”

The tally of victims so far includes FedEx in the United States, railroads in Germany and Russia, factories and phone companies across Europe. Among the worst impacted by the historic attack unprecedented in its breadth was Britain’s Public Health Service, where more than 45 facilities had to suspend operations and divert patients and surgeries.

“The impact on the U.S. seems to be negligible — very tiny impact, very few victims,” the senior intelligence official told ABC News Saturday, adding that there is “no attribution yet” to any individuals, groups or nation-states behind the attacks reported in more than 100 countries.

“It’s impacting overseas among those who have outdated software or pirated software,” the senior intelligence official said. “The U.S. government is better suited to react and respond to something like this than some other countries because of years of work between the private sector and the government.”

Cybersecurity experts believe the attack was carried out with the help of tools first developed by the U.S. National Security Agency for targeting terrorists and foreign adversaries, which was leaked to the public by a hacker group called The Shadow Brokers in April.

“They lost it, somebody stole the information published it on the internet, and now it’s being used against victims in the United States and elsewhere,” said John Bambenek of Fidelis Cybersecurity.

While Microsoft broadened access to a security patch on Saturday to thousands of users whose old Windows support agreements have expired, law enforcement and intelligence authorities around the world, led by Britain’s new cybersecurity agency, are working to track down whoever was responsible — with Russian organized crime considered a leading suspect, some experts said.

“The reason this is hitting so many computers at once is that they discovered a vulnerability in the most popular operating system in the world, in Microsoft windows,” said John Carlin, former assistant attorney general for national security and an ABC News contributor. “And they’re taking advantage of it. It’s one that Microsoft delivered a solution for, but a lot of people haven’t used it.”

As the attack spread to five continents, the damage was contained, for the moment, when a computer programmer in Great Britain says he stumbled upon the kill switch after Huss shared some of his work on social media. The researcher, who uses the pseudonym “MalwareTech” for personal security, registered a domain name buried in the code of the attack and was surprised to discover that it was the kill switch that sent a signal to stop the attacks.

“In this case, when we registered it, it turned out to be a kill switch,” Salim Neino, CEO of Kryptos Logic, which employs MalwareTech as a cybersecurity researcher, told ABC News. “We verified it and turned the information over to the FBI.”

The researcher behind “Malware Tech” sent the virus down a “sinkhole,” preventing it from spreading more widely.

“If malware tech had not sinkhole that domain as quickly as he had, we definitely could have seen many, many more infection that occurred,” Huss said. “Potentially hundreds of thousands and into the millions.”

While this attack has slowed, experts warn that networks remain vulnerable.

“This was a combination attack, obviously coordinated. We need to take the act of keeping our systems and devices up to date seriously,” said Tyler Cohen Wood, a former senior intelligence official involved in cyber operations. “Unfortunately, until this is taken more seriously, this massive wide scale type of attack is only the beginning.”</s>Teams of technicians are working "round the clock" to restore hospital computer systems in Britain after a global cyberattack that hit nearly 100 countries crippled the UK's health system.

The extortion attack, which locked up computers and held users' files for ransom, was believed to be the biggest of its kind ever recorded, disrupting services in countries including the US, Russia, Spain, Ukraine, India and Taiwan.

Europol, the European Union's police agency, said the onslaught was at "an unprecedented level and will require a complex international investigation to identify the culprits".

The ransomware appeared to exploit a vulnerability in Microsoft Windows that was purportedly identified by the US National Security Agency (NSA) for its own intelligence-gathering purposes and was later leaked to the internet.

Two security firms — Kaspersky Lab and Avast — said they had identified the malicious software behind the attack 99 countries, although both said the attack hit Russia hardest.

The Russian Interior Ministry, which runs the country's police, confirmed it was among those that fell victim to the "ransomware", which typically flashes a message demanding payment to release the user's data.

Spokesperson Irina Volk was quoted by the Interfax news agency Saturday as saying the problem had been "localised" and that no information was compromised.

A spokesperson for the Russian Health Ministry, Nikita Odintsov, said on Twitter that the cyberattacks on his ministry were "effectively repelled".

The national railway system said that although it was attacked, rail network operations were unaffected.

The attack also forced French carmaker Renault to halt its production at sites in France in an effort to stop the malware from spreading.

Two Renault union members spoke on the condition they remain anonymous because of the sensitive situation.

The consequences for the company remained unclear. Renault officials were not immediately available for comment.

British Home Secretary Amber Rudd said 45 public health organisations were hit, but she stressed that no patient data had been stolen.

The attack froze computers at hospitals across the country, with some cancelling all routine procedures. Patients were asked not to go to hospitals unless it was an emergency and even some key services like chemotherapy were cancelled.

British media had reported last year that most public health organisations were using an outdated version of Microsoft Windows that was not equipped with security updates.

Krishna Chinthapalli, a doctor at Britain's National Hospital for Neurology & Neurosurgery who wrote a paper on cybersecurity for the British Medical Journal, said many British hospitals use Windows XP software, introduced in 2001.

Security experts said the attack appeared to be caused by a self-replicating piece of software that enters companies and organisations when employees click on email attachments, then spreads quickly internally from computer to computer when employees share documents.

The security holes it exploits were disclosed several weeks ago by TheShadowBrokers, a mysterious group that has published what it said were hacking tools used by the NSA as part of its intelligence-gathering.

Shortly after that disclosure, Microsoft announced that it had already issued software "patches", or fixes, for those holes, but many users have not yet installed the fixes or are using older versions of Windows.

In the US, FedEx Corp reported that its Windows computers were "experiencing interference" from malware, but would not say if it had been hit by ransomware.

Elsewhere in Europe, the attack also hit companies including Spain's Telefonica, a global broadband and telecommunications company.

Germany's national railway said that departure and arrival display screens at its train stations were affected, but there was no impact on actual train services. Deutsche Bahn said it deployed extra staff to busy stations to provide customer information, and recommended that passengers check its website or app for information on their connections.

Other European organisations hit by the massive cyberattack included soccer clubs in Norway and Sweden, with IF Odd, a 132-year-old Norwegian soccer club, saying its online ticketing facility was down.

A spokesman for Prime Minister Malcolm Turnbull said there had been no confirmed reports of an impact on Australian organisations at this stage.</s>LONDON - Cyber security experts scrambled Saturday to contain the impact of an unprecedented global cyber-attack that hit Russia’s banks, British hospitals, FedEx and European car factories.

The hunt was on for the culprits behind the assault, which was being described as the biggest-ever cyber ransom attack. State agencies and major companies around the world were left reeling by the attacks which blocked access to files and demanded ransom money, forcing shutdowns of computer systems.

“The recent attack is at an unprecedented level and will require a complex international investigation to identify the culprits,” said Europol, Europe’s policing agency.

The attacks used ransomware, which locks users’ files unless they pay the attackers a designated sum in the virtual Bitcoin currency. Images appeared on victims’ screens demanding payment of $300 (275 euros) in Bitcoin, saying: “Ooops, your files have been encrypted!”

Payment is demanded within three days or the price is doubled, and if none is received within seven days the files will be deleted, according to the screen message. Mikko Hypponen, chief research officer at the Helsinki-based cyber security company F-Secure, told AFP that the attack was “the biggest ransomware outbreak in history”, saying that 130,000 systems in more than 100 countries had been affected.

He said Russia and India were hit particularly hard, largey because tech giant Microsoft’s older Windows XP operating software was still widely used there.

Microsoft said the situation was “painful” and that it was taking “all possible actions to protect our customers”.

It issued guidance for people to protect their systems, while taking the “highly unusual step” of providing a security update “for all customers to protect Windows platforms that are in custom support only”, including Windows XP, Windows 8, and Windows Server 2003 operating systems. US software firm Symantec said the majority of organisations affected were in Europe, and the attack was believed to be indiscriminate.

The ransomware spreads through corporate networks, “without user interaction, by exploiting a known vulnerability in Microsoft Windows,” it said.

The attacks apparently exploited a flaw exposed in documents leaked from the US National Security Agency (NSA).

Laurent Marechal, a cyber security expert at McAfee, said: “We still don’t know if this is worsening or easing. It is too early to tell. We are still in the analysis phase.” In the United States, package delivery group FedEx acknowledged it had been hit by malware and said it was “implementing remediation steps as quickly as possible.” French carmaker Renault was forced to stop production at sites in France, Slovenia and Romania, saying the measure was aimed at stopping the virus from spreading. Japanese carmaker Nissan’s plant in Sunderland, northeast England, was attacked but production shuts on Saturdays in any case.

Russia’s interior ministry said that some of its computers had been hit by a “virus attack” and that efforts were underway to destroy it. The country’s central bank said the Russian banking system was attacked, and the railway system also reported attempted breaches.

The central bank’s IT attack monitoring centre “detected mass distribution of harmful software” but no “instances of compromise”, it said. Germany’s Deutsche Bahn computers were also impacted, with the rail operator reporting that station display panels were affected. Some Italian universities were hit.

In a statement, computer security group Kaspersky Labs said it was “trying to determine whether it is possible to decrypt data locked in the attack - with the aim of developing a decryption tool as soon as possible.” On Saturday, a cyber security researcher told AFP he had accidentally discovered a “kill switch” that could prevent the spread of the ransomware.

The researcher, tweeting as @MalwareTechBlog, said registering a domain name used by the malware stops it from spreading, though it cannot help computers already affected.

A hacking group called Shadow Brokers released the malware in April claiming to have discovered the flaw from the NSA, Kaspersky said. Although Microsoft released a security patch for the flaw earlier this year, many systems have yet to be updated, researchers said.

“Unlike most other attacks, this malware is spreading primarily by direct infection from machine to machine on local networks, rather than purely by email,” said Lance Cottrell, chief scientist at the US technology group Ntrepid.

The unprecedented global cyberattack affected “more than 75,000 victims” in dozens of countries, French police said in a statement Saturday, the day after the ransomware hit Russia’s banks, British hospitals and European car factories among others.

“This is a provisional figure of the number of infected computers and could rise significantly over the coming days,” Valerie Maldonado, deputy head of the French police’s anti-Cybercrime Office told AFP.

Some said the attacks highlighted the need for agencies like the NSA to disclose security flaws so they can be patched.

G7 finance ministers meeting in Italy vowed to unite against cyber crime.

They said cyber incidents represent a growing threat to their economies and should be tackled as a priority. The danger will be discussed at the G7 leaders’ summit next month.

In Britain, the attack disrupted care at National Health Service facilities, forcing ambulances to divert and hospitals to postpone operations.

“There will be lessons to learn from what appears to be the biggest criminal cyber attack in history,” she said.

“But our immediate priority as a government is to disrupt the attack, restore affected services as soon as possible, and establish who was behind it so we can bring them to justice.”</s>(CNN) A massive global ransomware attack has struck hospitals, companies and government offices around the world, seizing control of affected computers until the victims pay a ransom.

The majority of the attacks targeted Russia, Ukraine and Taiwan. But the National Health Service in the United Kingdom and global firms such as Fedex also reported they had come under assault Friday. Experts suggested Saturday that the ransomware's progress had been halted, but new attacks could soon follow.

Here are five things to know:

It may not be over yet

Cybersecurity experts have been working round the clock to try to halt a malware attack that is unprecedented in scale.

The ransomware's progress has been halted by the accidental discovery late Friday of a "kill switch" hidden within the code by a security researcher, said cybersecurity consultant David Kennedy, formerly of the US National Security Agency.

"The software has actually stopped spreading across the world," he told CNN.

"He actually probably saved lives by accident," Kennedy said, referring to the security researcher who discovered the kill switch.

The ransomware was designed to repeatedly contact an unregistered domain listed in its code. The security researcher -- who uses the Twitter handle @MalwareTechBlog -- registered that domain to collect the ransomware traffic for analysis and to track infections.

However, a hacker could change the code to create a new variant and try the ransomware attack again.

Michael Gazeley, managing director of cybersecurity firm Network Box, told CNN that the danger is far from over and that a company's security patch on Saturday might not still work by Monday.

"A lot of people are going to go to work on Monday and click on a link in their mail -- completely oblivious that all of this is going on or have heard about it and think that it's over -- and suddenly wipe out their whole company," Gazeley said from Hong Kong.

"IT managers need to be extremely aware that new variants of this ransomware attack are being launched almost hourly, so they can't just check that their computer systems are protected, then relax, assuming everything will stay that way," he said.

Cybersecurity firm Avast said it tracked more than 75,000 ransomware attacks in 99 countries Friday. That number is likely to go up, Gazeley said.

European police agency Europol said it was working to support countries, saying the malware attack was at an "unprecedented level and requires international investigation."

What is it?

The malware is spread by taking advantage of a Windows vulnerability that Microsoft released a security patch for in March. But computers and networks that didn't update their systems remained at risk.

The cyberattack affected 16 organizations that are part of the National Health Service on Friday, causing some surgical procedures to be canceled and ambulances diverted. But the NHS said Saturday it does not have any evidence that patient data was breached.

A senior nurse with NHS Lanarkshire in Scotland posted a video on Twitter appealing to members of the public "to stay away from acute hospitals unless it's an absolute emergency situation" while its IT systems are affected.

The UK government has called a meeting of its crisis response committee, known as Cobra, on Saturday to discuss the situation.

Here's what you should do

If your computer has been affected, there's no guarantee that paying the ransom will restore it, Gazeley said. In past ransomware attacks, some victims have paid, only to find the key they are given doesn't work, while others have found their files are corrupted and can't be properly restored, he said.

Managers at many companies and other organizations have not taken steps to put proper cybersecurity systems in place despite talking about their importance, Gazeley said. "Most organizations just keep their heads in the sand," he said.

No one has yet identified the culprit.

"We see all the finger-pointing at the usual suspects, saying it's probably people in Russia or China, but, to quote Sherlock Holmes, it's not really a good idea to guess without the evidence," Gazeley said. Bitcoin is set up to be untraceable, so investigators will struggle to follow a money trail, he said.

Nonetheless, authorities around the world will be seeking to track down those responsible.

"I think these hackers have to recognize that these authorities will come after them with a vengeance," Gazeley said.

It also may never be known how much the hackers have netted from the ransomware attack. Many firms are unlikely to want to reveal they fell victim to it and whether they paid up.</s>A global cyberattack leveraging hacking tools widely believed by researchers to have been developed by the U.S. National Security Agency hit international shipper FedEx, disrupted Britain’s health system and infected computers in nearly 100 countries on Friday.

Britain’s National Cyber Security Center said Saturday teams are working “round the clock” to restore hospital computer systems after a global cyberattack that hit dozens of countries forced British hospitals to cancel and delay treatment for patients. In Russia, where a wide array of systems came under attack, officials said services had been restored or the virus contained.

The extortion attack, which locked up computers and held users’ files for ransom, was believed the biggest of its kind ever recorded, disrupting services from the U.S. to Russia, Spain and India. It appeared to exploit a vulnerability purportedly identified for use by the U.S. National Security Agency and later leaked to the internet.

Two security firms — Kaspersky Lab and Avast — said they had identified the malicious software behind the attack in upward of 70 countries, although both said the attack has hit Russia hardest.

WATCH: Hackers have used ransomware to launch a massive cyberattack, affecting more than 70 countires, including Canada. The worst impact seems to be in the United Kingdom, where some hospitals became crippled. Shirlee Engel reports.

The Russian Interior Ministry, which runs the country’s police, confirmed it was among those that fell victim to the “ransomware,” which typically flashes a message demanding payment to release the user’s data. Spokeswoman Irina Volk was quoted by the Interfax news agency Saturday as saying the problem had been “localized” and that no information was compromised.

A spokesman for the Russian Health Ministry, Nikita Odintsov, said on Twitter that the cyberattacks on his ministry were “effectively repelled.” The national railway system said that although it was attacked, rail network operations were unaffected.

British Home Secretary Amber Rudd said Saturday that 45 public health organizations were hit, but she stressed that no patient data had been stolen. The attack froze computers at hospitals across the country, with some cancelling all routine procedures. Patients were asked not to come to hospitals unless it was an emergency.

British media had reported last year that most public health organizations were using an outdated version of Microsoft Windows that was not equipped with security updates.

Elsewhere in Europe, the attack hit companies including Spain’s Telefonica, a global broadband and telecommunications company.

Germany’s national railway said Saturday that departure and arrival display screens at its stations were affected, but there was no impact on actual train services. Deutsche Bahn said it deployed extra staff to busy stations to provide customer information, and recommended that passengers check its website or app for information on their connections.

Other European organizations hit included football clubs in Norway and Sweden, with IF Odd, a 132-year-old Norwegian football club, saying its online ticketing facility was down.

International shipper FedEx Corp said some of its Windows computers were also infected. “We are implementing remediation steps as quickly as possible,” it said in a statement.

Still, only a small number of U.S.-headquartered organizations were hit because the hackers appear to have begun the campaign by targeting organizations in Europe, said Vikram Thakur, research manager with security software maker Symantec.

By the time they turned their attention to the United States, spam filters had identified the new threat and flagged the ransomware-laden emails as malicious, Thakur said.

The U.S. Department of Homeland Security said late on Friday that it was aware of reports of the ransomware, was sharing information with domestic and foreign partners and was ready to lend technical support.</s>Friday’s unprecedented ransomware attack may have stopped spreading to new machines -- at least briefly -- thanks to a "kill switch" that a security researcher has activated.

The ransomware, called Wana Decryptor or WannaCry, has been found infecting machines across the globe. It works by exploiting a Windows vulnerability that the U.S. National Security Agency may have used for spying.

The malware encrypts data on a PC and shows users a note demanding $300 in bitcoin to have their data decrypted. Images of the ransom note have been circulating on Twitter. Security experts have detected tens of thousands of attacks, apparently spreading over LANs and the internet like a computer worm.

However, the ransomware also contains a kill switch that may have backfired on its developers, according to security researchers.

Wana Decryptor infects systems through a malicious program that first tries to connect to an unregistered web domain. The kill switch appears to work like this: If the malicious program can’t connect to the domain, it’ll proceed with the infection. If the connection succeeds, the program will stop the attack.

A security researcher who goes by the name MalwareTech found that he could activate the kill switch by registering the web domain and posting a page on it.

MalwareTech's original intention was to track the ransomware's spread through the domain it was contacting. “It came to light that a side effect of us registering the domain stopped the spread of the infection,” he said in an email.

Security firm Malwarebytes and Cisco’s Talos security group reported the same findings and said new ransomware infections appear to have slowed since the kill switch was activated.

However, Malwarebytes researcher Jerome Segura said it’s too early to tell whether the kill switch will stop the Wana Decryptor attack for good. He warned that other versions of the same ransomware strain may be out there that have fixed the kill-switch problem or are configured to contact another web domain.

Unfortunately, computers already infected with Wana Decryptor will remain infected, he said.

Friday’s ransomware attack first spread through a massive email phishing campaign. At least some of those emails appeared to be messages from a bank about a money transfer, according to Cisco’s Talos group.

Victims who opened the attachment in the email were served with the ransomware, which takes over the computer, security researchers said.

The Wana Decryptor itself is no different from other typical ransomware strains. Once it infects the PC, it’ll encrypt all the files on the machine, and then demand the victim pay a ransom to free them.

But unlike other ransomware, Wana Decryptor has been built to spread quickly. It does so by incorporating a hacking tool that security researchers suspect came from the NSA and was leaked online last month.

The hacking tool, dubbed EternalBlue, can make it easy to hijack unpatched older Windows machines. Once Wana Decryptor has infected the first machine, it’ll attempt to spread to other machines on the same local network. Then it will scan the internet for vulnerable machines.

“It creates a snowball-like effect,” Segura said. “A few machines will be infected, then it’ll try to contact more.”

Security firm Avast said it had detected more than 75,000 attacks in 99 countries, with Russia, Ukraine and Taiwan among the hardest-hit countries. The U.K.’s National Health Service was one of the biggest organizations hit by the ransomware.

The ransomware was designed to work in numerous languages, including English, Chinese and Spanish, with ransom notes in each.

Segura advised victims not to pay the ransom because it encourages the hackers. Instead, he says they should wait for next few days as security researchers study the ransomware’s coding and try to come up with free ways to solve the infection.

On Friday, Microsoft said users will be protected from the ransomware if they’re running the company’s free antivirus software or have installed the latest patches.</s>Hong Kong: A cyber-security researcher appears to have discovered a "kill switch" that can prevent the spread of the WannaCry ransomware, for now, that has caused the cyberattacks wreaking havoc globally.

The researcher, tweeting as @MalwareTechBlog, said the discovery was accidental, but that registering a domain name used by the malware stops it from spreading.

"Essentially they relied on a domain not being registered and by registering it, we stopped their malware spreading," @MalwareTechBlog told AFP in a private message on Twitter.

 The researcher warned however that people "need to update their systems ASAP" to avoid attack.

"The crisis isn't over, they can always change the code and try again," @MalwareTechBlog said.

Friday's wave of cyberattacks, which affected dozens of countries, apparently exploited a flaw exposed in documents leaked from the US National Security Agency.

The attacks used a technique known as ransomware that locks users' files unless they pay the attackers a designated sum in the virtual currency Bitcoin.

Affected by the onslaught were computer networks at hospitals in Britain, Russia's interior ministry, the Spanish telecom giant Telefonica and the US delivery firm FedEx and many other organisations.

French carmaker Renault also announced it was attacked. A spokeswoman said the company was "doing what is needed to counter this attack."

"I will confess that I was unaware registering the domain would stop the malware until after I registered it, so initially it was accidental," @MalwareTechBlog tweeted.

Unfortunately however, computers already affected will not be helped by the solution. "So long as the domain isn't revoked, this particular strain will no longer cause harm, but patch your systems ASAP as they will try again."

The malware's name is WCry, but analysts were also using variants such as WannaCry.

Forcepoint Security Labs said in a Friday statement that the attack had "global scope" and was affecting networks in Australia, Belgium, France, Germany, Italy and Mexico. In the United States, FedEx acknowledged it had been hit by malware and was "implementing remediation steps as quickly as possible."

Also badly hit was Britain's National Health Service, which declared a "major incident" after the attack, which forced some hospitals to divert ambulances and scrap operations. Pictures posted on social media showed screens of NHS computers with images demanding payment of USD 300 (275 euros) in Bitcoin, saying: "Ooops, your files have been encrypted!"

It demands payment in three days or the price is doubled, and if none is received in seven days, the files will be deleted, according to the screen message.

A hacking group called Shadow Brokers released the malware in April claiming to have discovered the flaw from the NSA, according to Kaspersky Lab, a Russian cybersecurity provider.

Kaspersky researcher Costin Raiu cited 45,000 attacks in 74 countries as of Friday evening.</s>A ransomware attack appears to be spreading around the world, leveraging a hacking tool that may have come from the U.S. National Security Agency.

The ransomware, called Wanna Decryptor, struck hospitals at the U.K.’s National Health Service on Friday, taking down some of their network.

Spain’s computer response team CCN-CERT has also warned of a "massive attack" from the ransomware strain, amid reports that local telecommunications firm Telefonica was hit.

The ransomware, also known as WannaCry, works by leveraging a Windows vulnerability that came to light last month when a cache of mysterious hacking tools was leaked on the internet.

The tools, which security researchers suspect came from the NSA, include an exploit codenamed EternalBlue that makes hijacking older Windows systems easy. It specifically targets the Server Message Block (SMB) protocol in Windows, which is used for file-sharing purposes.

Microsoft has already patched the vulnerability, but only for newer Windows systems. Older ones, such as Windows Server 2003, are no longer supported, but still widely used among businesses, according to security experts.

That may have painted a giant bulls-eye for hackers to target these systems. The developer of Wanna Decryptor appears to have added the suspected NSA hacking tools to the ransomware’s code, said Matthew Hickey, the director of security provider Hacker House, in an email.

Security firm Avast said it has detected the ransomware, largely attacking Russia, Ukraine and Taiwan.

Another security research firm, MalwareTech, has created a page monitoring the attacks. They appear to have gone worldwide.

The Wanna Decryptor ransomware strikes by encrypting all the files on an infected PC, along with any other systems on the network the PC is attached to. It then demands a ransom of about $300 to $600 in bitcoin to release the files, threatening to delete them after a set period of days if the amount is not paid.

Security experts are urging organizations to patch vulnerable systems, upgrading to the latest versions of OSes, and making backups of any critical files.</s>A ransomware attack appears to be spreading around the world, leveraging a hacking tool that may have come from the U.S. National Security Agency.

The ransomware, called Wanna Decryptor, struck hospitals at the U.K.’s National Health Service on Friday, taking down some of their network.

Spain’s computer response team CCN-CERT has also warned of a "massive attack" from the ransomware strain, amid reports that local telecommunications firm Telefonica was hit.

The ransomware, also known as WannaCry, works by leveraging a Windows vulnerability that came to light last month when a cache of mysterious hacking tools was leaked on the internet.

The tools, which security researchers suspect came from the NSA, include an exploit codenamed EternalBlue that makes hijacking older Windows systems easy. It specifically targets the Server Message Block (SMB) protocol in Windows, which is used for file-sharing purposes.

Microsoft has already patched the vulnerability, but only for newer Windows systems. Older ones, such as Windows Server 2003, are no longer supported, but still widely used among businesses, according to security experts.

That may have painted a giant bulls-eye for hackers to target these systems. The developer of Wanna Decryptor appears to have added the suspected NSA hacking tools to the ransomware’s code, said Matthew Hickey, the director of security provider Hacker House, in an email.

Security firm Avast said it has detected the ransomware, largely attacking Russia, Ukraine and Taiwan.

Another security research firm, MalwareTech, has created a page monitoring the attacks. They appear to have gone worldwide.

The Wanna Decryptor ransomware strikes by encrypting all the files on an infected PC, along with any other systems on the network the PC is attached to. It then demands a ransom of about $300 to $600 in bitcoin to release the files, threatening to delete them after a set period of days if the amount is not paid.

Security experts are urging organizations to patch vulnerable systems, upgrading to the latest versions of OSes, and making backups of any critical files.</s>A ransomware attack appears to be spreading around the world, leveraging a hacking tool that may have come from the U.S. National Security Agency.

The ransomware, called Wanna Decryptor, struck hospitals at the U.K.’s National Health Service on Friday, taking down some of their network.

Spain’s computer response team CCN-CERT has also warned of a "massive attack" from the ransomware strain, amid reports that local telecommunications firm Telefonica was hit.

The ransomware, also known as WannaCry, works by leveraging a Windows vulnerability that came to light last month when a cache of mysterious hacking tools was leaked on the internet.

The tools, which security researchers suspect came from the NSA, include an exploit codenamed EternalBlue that makes hijacking older Windows systems easy. It specifically targets the Server Message Block (SMB) protocol in Windows, which is used for file-sharing purposes.

Microsoft has already patched the vulnerability, but only for newer Windows systems. Older ones, such as Windows Server 2003, are no longer supported, but still widely used among businesses, according to security experts.

That may have painted a giant bulls-eye for hackers to target these systems. The developer of Wanna Decryptor appears to have added the suspected NSA hacking tools to the ransomware’s code, said Matthew Hickey, the director of security provider Hacker House, in an email.

Security firm Avast said it has detected the ransomware, largely attacking Russia, Ukraine and Taiwan.

Another security research firm, MalwareTech, has created a page monitoring the attacks. They appear to have gone worldwide.

The Wanna Decryptor ransomware strikes by encrypting all the files on an infected PC, along with any other systems on the network the PC is attached to. It then demands a ransom of about $300 to $600 in bitcoin to release the files, threatening to delete them after a set period of days if the amount is not paid.

Security experts are urging organizations to patch vulnerable systems, upgrading to the latest versions of OSes, and making backups of any critical files.
A ransomware cyberattack continues to infect computers of private and public organisations around the world, and demand payment in bitcoin. The method used by the program, EternalBlue, was originally developed by the National Security Agency to exploit a vulnerability in Microsoft Windows, and was leaked by The Shadow Brokers in April.