Image copyright Screenshot Image caption Many reports suggest that screens around the world are getting this message, indicating a ransomware attack is to blame.

Companies across the globe are reporting that they have been struck by a major ransomware cyber-attack.

British advertising agency WPP is among those to say its IT systems have been disrupted as a consequence.

The virus, the source of which is not yet known, freezes the user's computer and demands an untraceable ransom be paid in the digital Bitcoin currency.

Ukrainian firms, including the state power company and Kiev's main airport, were among the first to report issues.

The Chernobyl nuclear power plant has also had to monitor radiation levels manually after its Windows-based sensors were shut down.

Interpol involvement

In a statement, the US National Security Council said government agencies were investigating the attack and that the US was "determined to hold those responsible accountable".

The US Department of Homeland Security advised victims not to pay the ransom, saying there was no guarantee that access to files would be restored.

The Russian anti-virus firm Kaspersky Lab said its analysis showed that there had been about 2,000 attacks - most in Ukraine, Russia and Poland.

Media playback is unsupported on your device Media caption Technology explained: what is ransomware?

The international police organisation Interpol has said it was "closely monitoring" the situation and liaising with its member countries.

Experts suggest the malware is taking advantage of the same weaknesses used by the WannaCry attack last month.

"It initially appeared to be a variant of a piece of ransomware that emerged last year," said computer scientist Prof Alan Woodward.

"The ransomware was called Petya and the updated version Petrwrap.

"However, now that's not so clear."

Kaspersky Lab reported that it believed the malware was a "new ransomware that has not been seen before" despite its resemblance to Petya.

As a result, the firm has dubbed it NotPetya. Kaspersky added that it had detected suspected attacks in Poland, Italy, Germany, France and the US in addition to the UK, Russia and Ukraine.

Andrei Barysevich, a spokesman for security firm Recorded Future, told the BBC such attacks would not stop because cyber-thieves found them too lucrative.

"A South Korean hosting firm just paid $1m to get their data back and that's a huge incentive," he said. "It's the biggest incentive you could offer to a cyber-criminal."

A bitcoin wallet associated with the outbreak has received several payments since the outbreak began. The wallet currently holds just over 3.5 bitcoins (£6,775; $8,670).

An email address associated with the blackmail attempt has been blocked by German independent email provider Posteo.

It means that the blackmailers have not been able to access the mailbox.

Problems have also affected:

the aircraft manufacturer Antonov, and two postal services

Russia's biggest oil producer, Rosneft

Danish shipping company Maersk, including its container shipping, oil, gas and drilling operations. A port in Mumbai is among those that has halted operations

a Pennsylvania hospital operator, Heritage Valley Health System, which reported its computer network was down, causing operations to be delayed - but it is not yet clear if it was subject to the same type of attack

US food giant Mondelez - whose brands include Oreo and Toblerone. A Cadbury factory in Tasmania, Australia is affected

Netherlands-based shipping company TNT, which said some of its systems needed "remediation"

French construction materials company St Gobain

US pharmaceuticals-maker Merck Sharp & Dohme

The local offices of the law firm DLA Piper - a sign in the firm's Washington DC office said: "Please remove all laptops from docking stations and keep turned off - no exceptions."

The attacks come two months after another global ransomware assault, known as WannaCry, which caused major problems for the UK's National Health Service.

Veteran security expert Chris Wysopal from Veracode said the malware seemed to be spreading via some of the same Windows code loopholes exploited by WannaCry. Many firms did not patch those holes because WannaCry was tackled so quickly, he added.

Image copyright Twitter/@NCA_UK Image caption The UK's National Crime Agency is investigating the threat

Those being caught out were also industrial firms that often struggled to apply software patches quickly.

"These organisations typically have a challenge patching all of their machines because so many systems cannot have down time," he said. "Airports also have this challenge."

Copies of the virus have been submitted to online testing systems that check if security software, particularly anti-virus systems, were able to spot and stop it.

"Only two vendors were able to detect it so many systems are defenceless if they are unpatched and relying on anti-virus," he said.

Image copyright Twitter/@RozenkoPavlo

Ukraine seems to have been particularly badly hit this time round.

Reports suggest that the Kiev metro system has stopped accepting payment cards while several chains of petrol stations have suspended operations.

Ukraine's deputy prime minister has tweeted a picture appearing to show government systems have been affected.

His caption reads: "Ta-daaa! Network is down at the Cabinet of Minister's secretariat."

Get news from the BBC in your inbox, each weekday morning</s>San Francisco: A global wave of cyberattacks on Tuesday exploited an already patched vulnerability in Windows software and appeared to have Ukraine as a primary target, according to computer security specialists.

The first reports of trouble came from Ukrainian banks, Kiev’s main airport and Rosneft, in a major incident reminiscent of the recent WannaCry virus. WannaCry was a version of ransomware that, once in a computer, locked away data from users who were then told to pay to have access returned to their own files.

The bedeviling onslaught Tuesday was also being referred to as ransomware by US software titan Microsoft and security specialists. “Our initial analysis found that the ransomware uses multiple techniques to spread, including one which was addressed by a security update previously provided for all platforms from Windows XP to Windows 10 (MS17-010),” a Microsoft spokesperson told AFP.

Also read: Cyberattack hits India, Jawaharlal Nehru Port Trust said to be affected

After the WannaCry scourge in May, Microsoft called on people to protect machines with the MS17-010 patch. The flaw—and the means to exploit it—had previously been disclosed in pirated documents about cyber weapons at the US National Security Agency.

Microsoft said that its anti-virus software detects and removes the ransomware used in the latest attack.

Microsoft is continuing to investigate the latest cyberattack and will take necessary steps to protect customers, the spokesperson said. People were also urged to be wary of clicking on email attachments or shared links, since that is a common trick used to unleash malicious code on computers. “As ransomware also typically spreads via email, customers should exercise caution when opening unknown files,” the Microsoft spokesperson said.

Identification of the way the latest ransomware initially got into machines was proving challenging, and the use of email was not confirmed, according to a post by Cisco Talos threat intelligence.

“Based on observed in-the-wild behaviours, the lack of a known, viable external spreading mechanism and other research we believe it is possible that some infections may be associated with software update systems for a Ukrainian tax accounting package called MeDoc,” Cisco Talos wrote.

Also read: GoldenEye ransomware follows in WannaCry’s footsteps

Ukraine’s central bank said several lenders had been hit in the country, hindering operations and leading the regulator to warn other financial institutions to tighten security measures. The virus is “spreading around the world, a large number of countries are affected,” Costin Raiu, a researcher at the Moscow-based Kaspersky Lab said in a Twitter post.

The cryptolocker demands $300 in bitcoins and does not name the encrypting program, which makes finding a solution difficult, Group IB spokesman Evgeny Gukov said.</s>'Petya' ransomware strikes computer servers across globe. Thousands of users has been hit by the virus in Ukraine, the UK, Germany, India, US, Australia.

This is the second global ransomware attack in the last two months after WannaCry attack.

The malicious software locks up computer files with unbreakable encryption. The 'Petya' ransomware takes over computers and demands $300, that needs to be paid in Bitcoin.

The cyber security firm Kaspersky Labs said, they traced the infections to "a new ransomware that has not been seen before"

Have you been affected by this ransomware attack?</s>The Petya ransomware that plagued companies in Europe on Tuesday might have stemmed from corrupted updates of an accountancy software. Reports said that the Ukrainian tax-filing software, M.E.Doc, might have been the source of infection, but the company has denied these allegations.

According to BBC, a number of security experts claim to have logs revealing M.E.Doc as the source. British malware expert Marcus Hutchins, who had been credited with ending the recent WannaCry ransomware outbreak, said that the software’s automatic update system was compromised, and instead of running updates for the software, it was downloading and running malware.

Malware infiltrates networks via email attachments aiming to fool users into clicking on it by mistake. The Petya ransomware, once it has taken over a computer, will encrypt important documents and files and then demands a ransom in Bitcoins; in this case, $300. If the ransom is not paid, the user will risk losing all their files.

The cyberattack led to disruptions among infected companies in 64 countries, including banks in Ukraine, Russian oil giant Rosneft, and the British advertising company, WPP.

Danish shipping giant Maersk was also one of the companies that took a hit in yesterday’s cyberattack. According to BBC, the company was unable to process new orders and was expecting delays on consignments.

Even a Cadbury factory in Tasmania was affected and was forced to stop production as computer systems went down, according to John Short, the Australian Manufacturing and Workers Union state secretary.

While M.E.Doc denied claims that the ransomware sprung from its update, Microsoft published a blog post analyzing how the infection took hold of Windows machines. It pointed the blame at the accounting software.

“Active infections of the ransomware initially started from the legitimate M.E.Doc update process,” the blog entry reveals.

Meanwhile, according to The Guardian, the Petya ransomware looks like just another cybercriminal taking advantage of cyberweapons leaked online. Security experts deem the payment mechanism of the attack to be too amateurish since the ransom note includes the same Bitcoin payment address for every victim. The malware also asks the victim to communicate via a single email address, which was already suspended by the email provider. This means that there is no way to communicate with the attacker to request the decryption key.

According to security researcher Grugq, the recent cyberattack has only a superficial resemblance to Petya, which was a money-making criminal enterprise.

“This is definitely not designed to make money. This is designed to spread fast and cause damage, with a plausibly deniable cover of ‘ransomware,'” Grugq wrote.

The origin of the attack remains unknown, although according to Wired, Ukrainian cybersecurity firms and government agencies pin the attacks on political operatives seeking to disrupt Ukrainian institutions as it targets infrastructure, including an electricity supplier, the state telecom, the central bank, and an airport.</s>'Petya' Cyberattack Cripples Ukraine, And Experts Say It's Spreading Globally

Ransomware hit at least six countries Tuesday, including Ukraine, where it was blamed for a large and coordinated attack on key parts of Ukraine's infrastructure, from government agencies and electric grids to stores and banks.

The malware is being called "Petya" — but in the security community, there is a debate over whether the ransomware is new or a variant that has been enhanced to make it harder to stop.

In either case, experts warn that it could spread globally, raising fears of another widespread attack like the WannaCry outbreak that struck in May.

The Maersk shipping company, based in Denmark, has confirmed that its "IT systems are down across multiple sites and business units due to a cyber attack."

In the U.S., the Department of Homeland Security spokesman Scott McConnell says the agency is "monitoring reports of cyber attacks affecting multiple global entities and is coordinating with our international and domestic cyber partners."

Any requests for help from DHS, McConnell says, are confidential.

Computers that are hit by the malware display a locked screen that demands a $300 bitcoin payment to retrieve files.

The malware promises to provide a specialized key to users who pay a ransom of $300 in bitcoins — the same ploy used by the infamous WannaCry ransomware that struck computers in more than 150 countries last month.

WannaCry was based on exploits stolen from the National Security Agency — including a program called EternalBlue, which exploited a Microsoft vulnerability. Petya reportedly shares some of WannaCry's traits — but while computers that had gotten a security patch were safe from WannaCry, Petya can also infect patched machines.

F-Secure executive Mikko Hypponen‏ says that Petya uses other exploits to spread in internal systems. "That's why patched systems can get hit."

Signs that this is a new strain led Kaspersky Lab malware analyst Vyacheslav Zakorzhevsky to say the outbreak comes from a "new ransomware we haven't seen before."

In an update, Kaspersky Labs said the attack has hit thousands of users, in Russia, Ukraine, Poland, Italy, the U.K., Germany, France and the U.S.

Kaspersky is an NPR funder, and we do work with them on our computers.

Ukraine's security experts are working to fix the problem, the government portal says. Until the issue is resolved, the government said, Ukrainians should simply turn their computers off.

While the malware's most concentrated effects were reported in Ukraine, several companies and at least one utility in Russia were also reportedly affected.

From Moscow, NPR's Lucian Kim reports, "Ukraine has blamed Russia for cyberattacks in the past, a charge Moscow denies. A number of Russian companies, including the state oil giant Rosneft, have also reported suffering cyberattacks today."

The attack struck at 2 p.m. local time, Ukraine's government says. Ukraine's National Bank was among the first to report a problem. In Russia, the malware hit companies such as Mars, Nivea and Mondelez International, according to the Tass news agency.

Ukraine's Anton Gerashchenko, a lawmaker and adviser to the interior minister. He says that despite its appearance as a ransomware hack, he believes the attack is actually the work of Russian agents who are waging a type of hybrid warfare to try to destabilize Ukraine.

The malware was delivered in emails that had been created to resemble business correspondence, Gerashchenko said on his Facebook page. He added the attack took days and likely weeks to stage before being activated.</s>Deadly ransomware Petya (aka ExPetr aka GoldenEye), which was first reported in a Ukraine-based company on Tuesday, is spreading like wildfire across the world.

What's more worrying is that, unlike WannaCry, which got stopped within hours after the attack, with a kill switch, there is no immediate fix for the Petya ransomware and it has already spread its tentacles to major government and corporate companies in developed markets such Russia, the US, the UK, France, Germany, Australia, Spain and Italy and developing region like India, which is steadily increasing its footprint in digitalisation, too is hit.

Read more: Is ExPetr aka Petya ransomware more dangerous than WannaCry? Here are critical security measures to prevent future attacks

Here's list of 20 high-profile companies affected by Petya ransomware (with inputs from AFP):
• National Bank of Ukraine and another Ukrainian bank Oschadbank
• One of the units of confectionary giant Mars Inc. is also affected
• Germany-based postal and logistics company Deutsche Post's Express division in the Ukraine is also affected
• Germany-based wholesale retail chain Metro is also said to be affected in Ukraine
• Reckitt Benckiser Group, which has subsidiary brands such as Enfamil, Dettol and Lysol, is also hit by the ransomware attack in India
• Indian arm of Beiersdorf AG, the maker of Nivea skin care products is also said to be affected by Petya
• The Jawaharlal Nehru Port (JNPT) in Maharashtra, India is affected by Petya ransomware
• Heritage Valley Health System, which runs hospitals and care facilities in Pittsburgh is also said to be affected by Petya ransomware.</s>A day after the latest cyberattack crippled computers internationally, starting in Ukraine, expert opinions vary widely over who was behind it and what the real goal was.

On Tuesday morning in Kyiv, Ukraine, a sudden blast brought traffic to a halt near the city’s main railway station. When the dust settled, a mangled Mercedes Benz sat smoking in the street. Dead inside the car was a colonel who worked with the country’s special operations forces.

As Ukrainian officials and news media began to process the grisly execution, the country was overwhelmed by a massive cyberattack. The hackers behind it brought down a range of infrastructure and companies throughout Ukraine.

Banks across the country, as well as the power grid, the postal service, government ministry offices, media organizations, cell providers and even Kyiv’s main airport began reporting they were victims of the hack. It was so sudden, and spread so fast, that Ukrainians across the country were left in shock.

Images relaying the damage began to flood social media. A shopper at a supermarket posted a picture showing every single cashier’s computer issuing a ransom demand. Shortly thereafter, Deputy Prime Minister Pavlo Rozenko posted a picture showing the same ransom demand on his own computer.

While there was no evidence of any connection between the car-bombing and the cyberattack, accusations of a large-scale, Russian-led campaign began to surface. The country’s intelligence service, the SBU, almost immediately attributed the cyberattack to the Kremlin.

Robert M. Lee, the founder and chief executive of the industrial cybersecurity company Dragos, Inc., however, tells CBC News that the statement was wrong.

A world-renowned expert in the cybersecurity of critical infrastructure, Lee said he understands why Ukrainian officials would be quick to blame Russia. Attacks against Ukraine’s power grid in 2015 and 2016 were widely attributed to Russia by cybersecurity experts.

“Ukraine is understandably hyper-sensitive to the conflict, and there’s many there that rightfully feel no one else is taking the attacks against Ukraine seriously,” said Lee.

The early analysis seemed to indicate that the hack was a relatively straightforward ransomware campaign that started in Ukraine and spread globally.

It affected a range of companies as diverse as British advertising agency WPP, Danish shipping giant Maersk, multinationals like food giant Mondelez, and the Russian energy giant Rosneft.

Through the evening, as more details came to light, other cybersecurity experts began to see the attack as something else.

Most importantly, they stopped believing that money was the motive of the attack, because the mechanism designed to actually bring in the money was so poorly designed.

On Tuesday evening, CBC News spoke to Nicholas Weaver, a network security researcher at the International Computer Science Institute in Berkeley, Calif., a leading independent, non-profit research centre.

He has dealt with “worms,” programs that autonomously spread from computer to computer, as a primary research focus for the last 16 years.

“It’s unlikely the attack was a well-engineered worm coupled to a horribly bad ransomware module done by crooks who won’t gain anything from their crime,” says Weaver.

He believes it was more likely a sophisticated attack disguised as ransomware, and while the attack didn’t necessarily have to be carried out at the nation-state level, he believes it couldn’t have been any regular hacker.

Mike Chobanyan, an expert in digital currency and the founder of the Kuna Bitcoin Agency also told CBC News that he didn’t think the idea was to collect bitcoins.

“They weren’t using TOR websites which would automatically generate Bitcoin addresses and automatically generate the code for the computers,” says Chobanyan.

“So it was sending Bitcoins to one specific address, and then how do you distinguish one from another?”

Chobanyan said ransomware attacks as far back as 2014 used better methods of capturing Bitcoin than this attack did, and if money was the goal, they would have improved on three-year-old attacks.

Information Systems Security Partners (ISSP), a Kyiv-based IT research firm that has been on the forefront of investigating cyberattacks against Ukraine, sent CBC News an early analysis Tuesday indicating that the formulation of the attack began between March and April of 2017.

ISSP said Tuesday’s perpetrators would have surely known that the vast majority of their victims didn’t have the technical skills to pay the relatively paltry ransom of $ 300 in Bitcoin. And a full day after the attack started and spread globally, the bitcoin wallet attributed to the attack only contained $ 9,746 US.

So if money wasn’t the purpose, what were the genuine motives and goals of the attackers?

ISSP’s Oleg Derevianko said the most important thing to determine now is what this stage of the attack, which began in March, may lead to next.

“Hackers intrude and stay within the network for long enough to install additional back doors and sleeping agents in order to come back once again after a new active phase and launch the final attack stage, aiming to either down the system, or exfiltrate data, or to combine those goals.”

As the day progressed, others suspected something about the attack didn’t add up.

Robert Pritchard, who spent seven years working in cybersecurity for the United Kingdom’s Ministry of Defence, told CBC News that although it’s too early to make any definitive conclusions, the attack was an outlier.

“The attack was very heavily targeted at Ukraine, and a lot of effort was put into making sure it was effective,” he said. “But the culprits either overlooked, or didn’t care to write, their ransoms in the language of the country they were focusing on attacking ….

“So if their goal was to make money, why did they focus so heavily on Ukraine?”

Beau Woods, of the cyber statecraft initiative at the Atlantic Council in Washington, D.C., told CBC News that as details came out, he was less convinced it was ransomware and more convinced that it was something disguised as ransomware.

“The question is, if ransomware wasn’t the motive, then what was?”</s>UK advertising and marketing giant WPP has been hit by a variant of the Petya ransomware

Another massive ransomware attack has broken out in Ukraine and appears to be spreading across the world in a similar vein of the WannaCry cyber attack.

The attack appears to be a variant of the Petya ransomware that has already been spotted in the cyber security wilds before, and hit multiple organisations in Ukraine, including the nation’s state power distributor, the National Bank of Ukraine and Kiev’s main airport.

Now the ransomware appears to have gone global with British advertising and marketing giant WPP noting that IT systems in several of the agencies it owns have been hit by the ransomware, which demands victims send $300 (£234) worth of Bitcoins to the hackers.

Companies in the Netherlands, Russia, and Germany. amongst others, are also reporting ransomware attacks.

GCHQ’s National Cyber Security Centre noted it is leeping a close eye to the spread of Petya: “We are aware of a global ransomware incident and are monitoring the situation closely.”

Further details of the cyber attacks, how they have spread and what types of systems Petya is attacking have yet to surface. Some speculation is laying blame at the doorstep of Russia, which has a rather tense relationship with Ukraine.

Malwabytes malware analyst Hasherezade, noted the cyber security firm is looking into the attacks as they develop.

“We are researching the attack as we speak, and so far it is too soon to tell the extent. What we have uncovered is that the ransomware seems to be distributed by Server Message Block (SMB), which is the same as the WannaCry incident that came before it,” she said.</s>Just over a month after the devastating WannaCry ransomware wreaked havoc worldwide, businesses and governments were hit with yet another massive cyberattack sweeping across the globe. On Tuesday, a malware based on Petya — a ransomware that first began making the rounds in 2016 — struck thousands of computers in Ukraine and Russia before spreading throughout Europe and elsewhere.

Some researchers have dubbed the new variant "NotPetya" or "GoldenEye" while some are calling it PetrWrap. Similar to WannaCry, the malware uses the Eternal Blue exploit as one of the means to propagate itself inside a targeted network, takes control of the infected machine and demands $300 (£234) in bitcoin before a victim can regain access.

The ransomware has already affected multiple high-profile firms including Britain's advertising giant WPP, Cadbury in Tasmania, Danish shipping company AP Moller-Maersk, French construction materials firm Saint-Gobain, Russian steel and oil companies Evraz and Rosneft

Ukrainian government departments, the central bank, the airport in Kiev and the metro network have all been affected by the cyberattack as well.

Here is the full list of countries affected by the attack as of the morning of 28 June, 2017:</s>A massive global cyberattack which began in Ukraine against its institutions and corporate networks has been halted, authorities said. According to a government statement, all enterprises, including state-owned ones, were now operating normally, Efe news reported. The situation was “under the full control” of cybersecurity specialists who were working to recover lost data, the government said. Meanwhile, Boryspil International Airport on the outskirts of capital Kiev was still without its main server.

Deputy airport manager Yevgueni Dijne told television channel 112.Ukraina that airlines were working autonomously with their own IT systems and the main departures and arrivals boards were being updated manually every 15 minutes. A type of ransomware called Petya hit dozens of European businesses and institutions on Tuesday, most of them based in Ukraine and Russia, in a cyberattack similar to another in May that affected more than 200,000 users in 150 countries.

You may also like to watch:

According to Russian cybersecurity company Group-IB, Petya is similar to the WannaCry virus, responsible for last month’s attack that paralysed computers and demanded a payment of $300 in bitcoins for a machine to be unblocked. Russian cybersecurity giant Kaspersky Lab warned that the virus had affected computers across the globe.
A major ransomware cyberattack strikes companies across the globe and 80% of all infections were in Ukraine.