As the world readies to open for business on Monday, companies and governments are bracing for a second round of cyberattacks in the aftermath of Friday’s WannaCry hack.

Indeed, security experts are already warning that a new version of WannaCry has emerged over the weekend that doesn’t have the kill switch protocol that stopped the initial version of the cyberattack late on Friday.

Earlier today, the U.K.’s National Cyber Security Center issued a new warning about the possibility of another attack.

Since the global coordinated ransomware attack on thousands of private and public sector organisations across dozens of countries on Friday, there have been no sustained new attacks of that kind. But it is important to understand that the way these attacks work means that compromises of machines and networks that have already occurred may not yet have been detected, and that existing infections from the malware can spread within networks. This means that as a new working week begins it is likely, in the UK and elsewhere, that further cases of ransomware may come to light, possibly at a significant scale.

By the end of the workday on Friday, when the initial version of the WannaCry hack was detected, hundreds of thousands of computers were affected.

Past 24 hours #WannaCry infection map. What a bloodbath. pic.twitter.com/k5QvK2N0pu — Patrick Schanen (@patrickschanen) May 14, 2017

When workers in Asia wake up on Monday morning, security experts expect another wave of computers to be exposed to the ransomware attack.

The New York Times reported that some security industry observers are saying that the second wave of attacks has already begun.

Writing on his blog, Matt Suiche, the founder of Comae Technologies, elaborated on some of the new variants of the ransomware that cybersecurity specialists are finding in the wild.

Today (14 May 2017), 2 new variants appeared. One working which I blocked by registering the new domain name, and the second which is only partially working because it only spreads and does *not* encrypt files due to a corrupted archive. A new variant had been caught by @benkow_ and sent to me for analysis. I reversed it and found a new kill-switch ( ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com ) which I immediately registered to stop the new wave of global attacks. Then, I synchronized with @MalwareTechBlog and @2sec4u to map the new domain to sinkhole name servers to feed the live interactive infection map. This is 32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf . A new variant with no kill-switch caught by Kaspersky. Although, this build does only work *partially* as the ransomware archive is corrupted — the spreading still works though. This is 07c44729e2c570b37db695323249474831f5861d45318bf49ccf5d2f5c8ea1cd .

And the anonymous cybersecurity researcher who discovered the kill switch on the original malware attack has his own warning for system administrators.

Version 1 of WannaCrypt was stoppable but version 2.0 will likely remove the flaw. You're only safe if you patch ASAP. — MalwareTech (@MalwareTechBlog) May 14, 2017

By now, you’re likely aware that the original malware attack originated from leaked code developed by the National Security Administration. The attack worked by exploiting a flaw in Microsoft Windows. Although Microsoft had provided a patch for the software several months ago, not everyone updated their systems, which led to the vulnerabilities that the still-anonymous hackers exploited.

According to this Symantec explainer, the ransomware encrypts data files and asks users to pay a bitcoin ransom of $300, which doubles if payment isn’t made after three days. After a week, the encrypted files will be deleted.

Figure 1 Ransom demand screen displayed by WannaCry Trojan

If you’re curious how Ransomware attacks work, here’s a primer from security firm Carbon Black.

Companies affected by the attacks included the Spanish telecommunications company, Telefonica, Gas Natural and electricity provider Iberdrola. National Health Services hospitals in the UK were also affected by the attack. As was FedEx in the U.S. and Renault in France.

The attacks also hit Germany’s rail system, Russia’s Interior Ministry and universities around China, according to reports in The New York Times.

“It’s no surprise that over 45,000 targets across the globe were attacked by the WannaCry ransomware,” wrote Mark Kuhr, the co-founder and chief technology officer of the white hat penetration testing and bug bounty hunting startup Synack. “The frequency of these attacks will continue to rise exponentially because ransomware is such a lucrative business for criminal enterprises. A recent IBM survey of 1,000 business professionals found that 60% of victims are willing to pay ransom to get data back safely.”

Part of what makes these attacks so inevitable is the availability of these tools to almost anyone. Would-be hackers don’t even need to be that skilled to deploy these kinds of malware programs.

Thanks to groups like Shadow Brokers, which leaked the National Security Agency’s hacking tools, malware like the kind that seized systems around the globe are available to anyone with an internet connection.</s>Friday’s unprecedented ransomware attack may have stopped spreading to new machines -- at least briefly -- thanks to a "kill switch" that a security researcher has activated.

The ransomware, called Wana Decryptor or WannaCry, has been found infecting machines across the globe. It works by exploiting a Windows vulnerability that the U.S. National Security Agency may have used for spying.

The malware encrypts data on a PC and shows users a note demanding $300 in bitcoin to have their data decrypted. Images of the ransom note have been circulating on Twitter. Security experts have detected tens of thousands of attacks, apparently spreading over LANs and the internet like a computer worm.

However, the ransomware also contains a kill switch that may have backfired on its developers, according to security researchers.

Wana Decryptor infects systems through a malicious program that first tries to connect to an unregistered web domain. The kill switch appears to work like this: If the malicious program can’t connect to the domain, it’ll proceed with the infection. If the connection succeeds, the program will stop the attack.

A security researcher who goes by the name MalwareTech found that he could activate the kill switch by registering the web domain and posting a page on it.

MalwareTech's original intention was to track the ransomware's spread through the domain it was contacting. “It came to light that a side effect of us registering the domain stopped the spread of the infection,” he said in an email.

Security firm Malwarebytes and Cisco’s Talos security group reported the same findings and said new ransomware infections appear to have slowed since the kill switch was activated.

However, Malwarebytes researcher Jerome Segura said it’s too early to tell whether the kill switch will stop the Wana Decryptor attack for good. He warned that other versions of the same ransomware strain may be out there that have fixed the kill-switch problem or are configured to contact another web domain.

Unfortunately, computers already infected with Wana Decryptor will remain infected, he said.

Friday’s ransomware attack first spread through a massive email phishing campaign. At least some of those emails appeared to be messages from a bank about a money transfer, according to Cisco’s Talos group.

Victims who opened the attachment in the email were served with the ransomware, which takes over the computer, security researchers said.

The Wana Decryptor itself is no different from other typical ransomware strains. Once it infects the PC, it’ll encrypt all the files on the machine, and then demand the victim pay a ransom to free them.

But unlike other ransomware, Wana Decryptor has been built to spread quickly. It does so by incorporating a hacking tool that security researchers suspect came from the NSA and was leaked online last month.

The hacking tool, dubbed EternalBlue, can make it easy to hijack unpatched older Windows machines. Once Wana Decryptor has infected the first machine, it’ll attempt to spread to other machines on the same local network. Then it will scan the internet for vulnerable machines.

“It creates a snowball-like effect,” Segura said. “A few machines will be infected, then it’ll try to contact more.”

Security firm Avast said it had detected more than 75,000 attacks in 99 countries, with Russia, Ukraine and Taiwan among the hardest-hit countries. The U.K.’s National Health Service was one of the biggest organizations hit by the ransomware.

The ransomware was designed to work in numerous languages, including English, Chinese and Spanish, with ransom notes in each.

Segura advised victims not to pay the ransom because it encourages the hackers. Instead, he says they should wait for next few days as security researchers study the ransomware’s coding and try to come up with free ways to solve the infection.

On Friday, Microsoft said users will be protected from the ransomware if they’re running the company’s free antivirus software or have installed the latest patches.</s>Das Schlimmste steht offenbar erst noch bevor: Sicherheitsexperten gehen davon aus, dass die Cyberangriffe mit Erpressersoftware noch nicht vorüber sind. Sie warnen zudem vor neuen Attacken.

"Ich gehe davon aus, dass es von dieser Attacke früher oder später eine weitere Welle geben wird", sagte Rüdiger Trost von der IT-Sicherheitsfirma F-Secure. Der Angriff über die Windows-Sicherheitslücke habe zu gut funktioniert, um aufzugeben.

Experten fürchten, dass es am Montag vor allem im bislang noch nicht so stark betroffenen Asien größere Probleme geben könnte, wenn sich viele Mitarbeiter nach dem Wochenende an ihrem Arbeitsplatz einloggen.

Europol zählt 200.000 Betroffene

Nach Angaben von Europol hat die weltweite Cyber-Attacke bisher mindestens 150 Länder getroffen. "Nach der letzten Zählung hat es 200.000 Opfer gegeben", sagte der Chef der europäischen Ermittlungsbehörde, Rob Wainwright, dem britischen Fernsehsender ITV. Darunter seien auch große Firmen. Die Rechner wurden von dem Erpressungstrojaner "WannaCry" befallen, der sie verschlüsselt und Lösegeld verlangt.

Die Welt habe mit einer wachsenden Bedrohung zu tun, sagte Wainwright. Auch er rechnet mit weiter steigenden Zahlen zu Beginn der neuen Arbeitswoche. Europol schlug ein internationales Vorgehen der Behörden vor, um die Hintermänner zu finden.

Der britische IT-Forscher, der die Ausbreitung des Erpressungstrojaners am Freitag gestoppt hatte, glaubt sogar an eine baldige neue Attacke. "Möglicherweise am Montagmorgen", sagte der 22-Jährige, der weiterhin anonym bleiben will, dem Sender BBC. "Da ist viel Geld im Spiel. Es gibt keinen Grund für sie, aufzuhören." Es sei kein großer technischer Aufwand, den Code zu ändern und eine neue Angriffswelle zu starten.

Der Computerexperte Linus Neumann vom Chaos Computer Club schreibt in einem Gastbeitrag auf SPIEGEL ONLINE, dass bereits eine neue Variante der Schadsoftware im Umlauf ist. Diesmal ohne einen Kill Switch, mit dessen Hilfe der erste Angriff gestoppt werden konnte.

Ausmaß des Schadens bisher unklar

Noch ist das genaue Ausmaß der Schäden in Deutschland unklar. Das Bundesamt für Sicherheit in der Informationstechnik (BSI) rechnet erst in den kommenden Tagen mit einem Überblick. Die von der Attacke betroffene Deutsche Bahn kämpfte am Sonntag noch immer mit den Auswirkungen des Angriffs. In Deutschland übernahm das Bundeskriminalamt die Ermittlungen.

Zu den Opfern der Cyber-Attacken zählen (Auswahl): Deutschland: Computer der Deutschen Bahn sind von dem Angriff erfasst. Betroffen seien Anzeigetafeln und Fahrkartenautomaten, teilte ein Sprecher mit. Der Zugverkehr rolle aber. Großbritannien: Die Schadsoftware hat in mehreren Krankenhäusern die Computer blockiert. Die Bevölkerung wurde gebeten, nur in wirklichen Notfällen zu kommen, einige Patienten mussten verlegt werden.

Die Schadsoftware hat in mehreren die Computer blockiert. Die Bevölkerung wurde gebeten, nur in wirklichen Notfällen zu kommen, einige Patienten mussten verlegt werden. Russland: Das Innenministerium bestätigte, dass es angegriffen worden sei. Rund 1000 Computer seien betroffen. Allerdings seien keine Daten verloren gegangen - inzwischen habe man die Attacke im Griff.

Das Innenministerium bestätigte, dass es angegriffen worden sei. Rund 1000 Computer seien betroffen. Allerdings seien keine Daten verloren gegangen - inzwischen habe man die Attacke im Griff. USA: Der US-Logistikriese FedEx entschuldigte sich bei Kunden für Ausfälle durch den Angriff.

Der US-Logistikriese entschuldigte sich bei Kunden für Ausfälle durch den Angriff. Spanien: Die spanische Telefónica bestätigte einen "Cybersicherheitsvorfall". Der Service soll davon jedoch nicht beeinträchtigt worden sein.

Die spanische bestätigte einen "Cybersicherheitsvorfall". Der Service soll davon jedoch nicht beeinträchtigt worden sein. Portugal: Der Telekom-Konzern Portugal Telecom (PT) riet den Mitarbeitern, alle Windows-Rechner herunterzufahren.

Der Telekom-Konzern riet den Mitarbeitern, alle Windows-Rechner herunterzufahren. Schweden: 70 Computer der Gemeinde Timrå waren betroffen, wie es auf der Webseite der Verwaltung hieß. Die Monitore der Mitarbeiter seien erst blau, dann schwarz geworden. Auch der Stahlkonzern Sandvik wurde nach eigenen Angaben angegriffen.

70 Computer der Gemeinde Timrå waren betroffen, wie es auf der Webseite der Verwaltung hieß. Die Monitore der Mitarbeiter seien erst blau, dann schwarz geworden. Auch der Stahlkonzern wurde nach eigenen Angaben angegriffen. Frankreich: Der Autobauer Renault stoppte wegen der Angriffe die Produktion in einigen Werken, "um eine Ausbreitung der Schadsoftware zu verhindern". Taiwan: Der kleine Inselstaat südlich von China gilt als einer der Hauptziele der Hacker - genauso wie die Ukraine.

Neu an dem Angriff von Freitag war, dass der Erpressungstrojaner selbstständig neue Computer infizierte, ohne dass ein Nutzer etwa auf einen präparierten Link klicken musste. Dadurch konnte sich das Schadprogramm binnen weniger Stunden weltweit ausbreiten und erreichte ein für Lösegeld-Software beispielloses Ausmaß.

Die Schadsoftware basiert auf einer Sicherheitslücke, die ursprünglich vom US-Geheimdienst NSA für seine Überwachung ausgenutzt wurde. Bereits vor einigen Monaten hatten Hacker sie öffentlich gemacht. Microsoft hatte zwar schon Anfang des Jahres ein Update veröffentlicht, das die Schwachstelle schloss - aber jetzt traf es die Computer, auf denen das Update noch nicht installiert wurde.

Nach der Attacke stellte der Konzern auch ein Update für das veraltete Windows XP bereit, das eigentlich nicht mehr gewartet wird. Der Angriff traf laut Experten viele XP-Rechner. Das aktuelle Windows 10 war dagegen nicht betroffen.

Erpresser-Viren - wie kann ich mich schützen? Seien Sie vorsichtig mit E-Mail-Anhängen Deaktivieren Sie die Makro-Funktion in Dokumenten, die Sie per E-Mail erhalten. Vor allem bei Nachrichten von fremden Personen sollten Sie vorsichtig sein. "Locky" und andere Ransomware-Trojaner werden nach Angaben von Sicherheitsexperten meist über E-Mail-Anhänge eingeschleust, die sich etwa als harmloses Worddokument tarnen, aber im Hintergrund die gefährliche Software ausführen. Völlige Sicherheit lässt sich so aber nicht erreichen: Auch als "drive-by", also einfach beim Besuch einer Website kann man sich Ransomware einfangen. Es traf sogar schon Leser von Seiten wie Nytimes.com und BBC.com. Daten per Back-up sichern Ransomware-Trojaner verschlüsseln Ihre Dateien oft so gut, dass sie dauerhaft unbrauchbar werden. Sichern Sie Ihre Daten also möglichst per Back-up, damit Sie Ihre Dokumente im Notfall wiederherstellen können. Am besten eignet sich dafür eine Festplatte, die nicht ständig mit dem PC verbunden ist, wie eine externe USB-Platte. Auch ein Cloud-Back-up kann sinnvoll sein - das sollte man dann aber sicher verschlüsseln. Verwenden Sie aktuelle Software Um Sicherheitslücken zu schließen, sollten Sie möglichst alle Programme auf Ihrem Rechner auf den neuesten Stand bringen. Installieren Sie Patches für den Browser, für Office-Anwendungen und den Flash-Player. Malware-Programme nutzen Sicherheitslücken in dieser Software aus. Benutzen Sie aktuelle Virenschutz-Software Die neuesten Versionen der Erpressertrojaner schaffen es zuweilen auch an aktuellen Sicherheitsprogrammen vorbei, aber schon bekannte Varianten kann ein Virenschutzprogramm abfangen. Diverse Anbieter haben auch kostenlose Versionen ihrer Schutzsoftware im Programm, die zumindest einen Basisschutz bieten, und bereits bekannte Virensignaturen erkennen.



Unklar ist auch, wie viele Nutzer auf die Lösegeldforderungen eingehen werden. Nach Erkenntnissen von Sicherheitsexperten, die von den Erpressern genannte Bitcoin-Konten beobachten, wurden zunächst nur wenige Zehntausend Dollar eingezahlt.

Die Summe könnte aber steigen, wenn von den Erpressern gesetzte Fristen näherrücken. Wer bis zum 15. Mai nicht bezahlt hat, soll dann bereits 600 Dollar rausrücken, das Doppelte der ursprünglich geforderten Summe. Am 19. Mai sollen die verschlüsselten Daten angeblich unwiederbringlich verschwinden.

Experten raten davon ab, den Forderungen nachzukommen. Denn Privatnutzer und Firmen, die zahlen, finanzieren die Angreifer, die dadurch mehr Ressourcen haben, nach Schwachstellen zu suchen oder sie zu kaufen. Wer allerdings kein Back-up für seine Daten hat, dem bleibt kaum eine andere Möglichkeit.</s>Friday’s unprecedented ransomware attack may have stopped spreading to new machines -- at least briefly -- thanks to a "kill switch" that a security researcher has activated.

The ransomware, called Wana Decryptor or WannaCry, has been found infecting machines across the globe. It works by exploiting a Windows vulnerability that the U.S. National Security Agency may have used for spying.

The malware encrypts data on a PC and shows users a note demanding $300 in bitcoin to have their data decrypted. Images of the ransom note have been circulating on Twitter. Security experts have detected tens of thousands of attacks, apparently spreading over LANs and the internet like a computer worm.

However, the ransomware also contains a kill switch that may have backfired on its developers, according to security researchers.

Wana Decryptor infects systems through a malicious program that first tries to connect to an unregistered web domain. The kill switch appears to work like this: If the malicious program can’t connect to the domain, it’ll proceed with the infection. If the connection succeeds, the program will stop the attack.

A security researcher who goes by the name MalwareTech found that he could activate the kill switch by registering the web domain and posting a page on it.

MalwareTech's original intention was to track the ransomware's spread through the domain it was contacting. “It came to light that a side effect of us registering the domain stopped the spread of the infection,” he said in an email.

Security firm Malwarebytes and Cisco’s Talos security group reported the same findings and said new ransomware infections appear to have slowed since the kill switch was activated.

However, Malwarebytes researcher Jerome Segura said it’s too early to tell whether the kill switch will stop the Wana Decryptor attack for good. He warned that other versions of the same ransomware strain may be out there that have fixed the kill-switch problem or are configured to contact another web domain.

Unfortunately, computers already infected with Wana Decryptor will remain infected, he said.

Friday’s ransomware attack first spread through a massive email phishing campaign. At least some of those emails appeared to be messages from a bank about a money transfer, according to Cisco’s Talos group.

Victims who opened the attachment in the email were served with the ransomware, which takes over the computer, security researchers said.

The Wana Decryptor itself is no different from other typical ransomware strains. Once it infects the PC, it’ll encrypt all the files on the machine, and then demand the victim pay a ransom to free them.

But unlike other ransomware, Wana Decryptor has been built to spread quickly. It does so by incorporating a hacking tool that security researchers suspect came from the NSA and was leaked online last month.

The hacking tool, dubbed EternalBlue, can make it easy to hijack unpatched older Windows machines. Once Wana Decryptor has infected the first machine, it’ll attempt to spread to other machines on the same local network. Then it will scan the internet for vulnerable machines.

“It creates a snowball-like effect,” Segura said. “A few machines will be infected, then it’ll try to contact more.”

Security firm Avast said it had detected more than 75,000 attacks in 99 countries, with Russia, Ukraine and Taiwan among the hardest-hit countries. The U.K.’s National Health Service was one of the biggest organizations hit by the ransomware.

The ransomware was designed to work in numerous languages, including English, Chinese and Spanish, with ransom notes in each.

Segura advised victims not to pay the ransom because it encourages the hackers. Instead, he says they should wait for next few days as security researchers study the ransomware’s coding and try to come up with free ways to solve the infection.

On Friday, Microsoft said users will be protected from the ransomware if they’re running the company’s free antivirus software or have installed the latest patches.</s>Update — After reading this article, if you want to know, what has happened so far in past 4 days and how to protect your computers from WannaCry, read our latest article "WannaCry Ransomware: Everything You Need To Know Immediately." After reading this article, if you want to know, what has happened so far in past 4 days and how to protect your computers from WannaCry, read our latest article "

"If NSA had privately disclosed the flaw used to attack hospitals when they *found* it, not when they lost it, this may not have happened," NSA whistleblower Edward Snowden says.

Kill-Switch for WannaCry? No, It's not over yet!

hxxp://www[.]iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com

hxxp://ifferfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com/

Since the kill-switch feature was in the SMB worm, not in the ransomware module itself., "WannaCrypt ransomware was spread normally long before this and will be long after, what we stopped was the SMB worm variant," MalwareTech told The Hacker News.

If you receive WannaCry via an email, a malicious torrent, or other vectors (instead of SMB protocol).

If by chance your ISP or antivirus or firewall blocks access to the sinkhole domain.

If the targeted system requires a proxy to access the Internet, which is a common practice in the majority of corporate networks.

If someone makes the sinkhole domain inaccessible for all, such as by using a large-scale DDoS attack.

WannaCry 2.0, Ransomware With *NO* Kill-Switch Is On Hunt!

CIRCL c/o securitymadein.lu

"I can confirm we've had versions without the kill switch domain connect since yesterday," told The Hacker News.

Updated: WannaCry 2.0 is Someone Else's Work

"The patched version matt described does attempt to spread. It's a full set which was modified by someone with a hex editor to disable the kill switch," Raiu told me.

"Given the high profile of the original attack, it's going to be no surprise at all to see copycat attacks from others, and perhaps other attempts to infect even more computers from the original WannaCry gang. The message is simple: Patch your computers, harden your defences, run a decent anti-virus, and - for goodness sake - ensure that you have secure backups." Cyber security expert Graham Cluley told The Hacker News.

"The next attacks are inevitable, you can simply patch the existing samples with a hex editor and it'll continue to spread," Matthew Hickey, a security expert and co-founder of Hacker House told me.

"We will see a number of variants of this attack over the coming weeks and months so it's important to patch hosts. The worm can be modified to spread other payloads not just WCry and we may see other malware campaigns piggybacking off this samples success."

"The worm functionality attempts to infect unpatched Windows machines in the local network. At the same time, it also executes massive scanning on Internet IP addresses to find and infect other vulnerable computers. This activity results in large SMB traffic from the infected host," Microsoft says.

Video Demo of WannaCry Ransomware Infection



And Second one…

Get Prepared: Upgrade, Patch OS & Disable SMBv1

WannaCry has Hit Over 200,000 Systems in 150 Countries, Warned Europol

"We are running around 200 global operations against cyber crime each year, but we've never seen anything like this," Wainwright said, as quoted by BBC.

"The latest count is over 200,000 victims in at least 150 countries. Many of those victims will be businesses, including large corporations. The global reach is unprecedented."

If you are following the news, by now you might be aware that a security researcher has activated a "Kill Switch" which apparently stopped the WannaCry ransomware from spreading further.But it's not true, neither the threat is over yet.However, the kill switch has just slowed down the infection rate.Multiple security researchers have claimed that there are more samples of WannaCry out there, with different 'kill-switch' domains and without any kill-switch function, continuing to infect unpatched computers worldwide (find more details below).So far, over 237,000 computers across 99 countries around the world have been infected, and the infection is still rising even hours after the kill switch was triggered by the 22-years-old British security researcher behind the twitter handle ' MalwareTech .'For those unaware, WannaCry is an insanely fast-spreading ransomware malware that leverages a Windows SMB exploit to remotely target a computer running on unpatched or unsupported versions of Windows.Once infected, WannaCry also scans for other vulnerable computers connected to the same network, as well scans random hosts on the wider Internet, to spread quickly.The SMB exploit, currently being used by WannaCry, has been identified as EternalBlue, a collection of hacking tools allegedly created by the NSA and then subsequently dumped by a hacking group calling itself " The Shadow Brokers " over a month ago.In our previous two articles , we have put together more information about this massive ransomware campaign, explaining how MalwareTech accidentally halted the global spread of WannaCry by registering a domain name hidden in the malware.The above-mentioned domain is responsible for keeping WannaCry propagating and spreading like a worm, as I previously explained that if the connection to this domain fails, the SMB worm proceeds to infect the system.Fortunately, MalwareTech registered this domain in question and created a sinkhole – tactic researchers use to redirect traffic from the infected machines to a self-controlled system. (Matthieu Suiche, a security researcher, has confirmed that he has found a new WannaCry variant with a different domain for kill-switch function, which he registered to redirect it to a sinkhole in an effort to slows down the infections.The newly discovered WannaCry variant works exactly like the previous variant that wreaked havoc across the world Friday night.But, if you are thinking that activating the kill switch has completely stopped the infection, then you are mistaken.You should know that the kill-switch would not prevent your unpatched PC from getting infected, in the following scenarios:MalwareTech also confirmed THN that some "Mirai botnet skids tried to DDoS the [sinkhole] server for lulz," in order to make it unavailable for WannaCry SMB exploit, which triggers infection if the connection fails. But "it failed hardcore," at least for now.Initially, this part of story was based on research of a security researcher, who earlier claimed to have the samples of new WannaCry ransomware that comes with no kill-switch function. But for some reason, he backed off. So, we have removed his references from this story for now.However, shortly after that, we were confirmed by Costin Raiu , the director of global research and analysis team at Kaspersky Labs, that his team had seen more WannaCry samples on Friday that did not have the kill switch.Raiu from Kaspersky shared some samples, his team discovered, with Suiche, who analysed them and just confirmed that there is a WannaCrypt variant without kill switch, and equipped with SMB exploit that would help it to spread rapidly without disruption.What's even worse is that the new WannaCry variant without a kill-switch believed to be created by someone else, and not the hackers behind the initial WannaCry ransomware.However, Suiche also confirmed that the modified variant with no kill switch is corrupted, but this doesn't mean that other hackers and criminals would not come up with a working one.Expect a new wave of ransomware attack, by initial attackers and new ones, which would be difficult to stop, until and unless all vulnerable systems get patched.Even after WannaCry attacks made headlines all over the Internet and Media, there are still hundreds of thousands of unpatched systems out there that are open to the Internet and vulnerable to hacking.Believe me, the new strain of WannaCry 2.0 malware would not take enough time to take over another hundred of thousand vulnerable systems.Hickey has also provided us two video demonstrations, showing packet traces that confirm the use of Windows SMB vulnerability (MS17-010).Since WannaCry is a single executable file, it can also be spread through other regular exploit vectors, such as spear phishing, drive-by-download attack, and malicious torrent files download, warned Hickey.MalwareTech also warned of the future threat, saying"Informed NCSC, FBI, etc. I've done as much as I can do currently, it's up to everyone to patch," he added.As we notified today, Microsoft took an unusual step to protect its customers with an unsupported version of Windows — including Windows XP, Vista, Windows 8, Server 2003 and 2008 — by releasing security patches that fix SMB flaw currently being exploited by the WannaCry ransomware.Even after this, I believe, many individuals remain unaware of the new patches and many organizations, as well as embedded machines like ATM and digital billboard displays, running on older or unpatched versions of Windows, who are considering to upgrade their operating system, would take time as well as it’s going to cost them money for getting new licenses.So, users and organizations are strongly advised to install available Windows patches as soon as possible, and also consider disabling SMBv1 ( follow these steps ), to prevent similar future cyber attacks.Apply Patches. Microsoft has been very generous to you.Almost all antivirus vendors have already been added signatures to protect against this latest threat. Make sure you are using a good antivirus, and keep it always up-to-date.Moreover, you can also follow some basic security practices I have listed to protect yourself from such malware threats.Speaking to Britain's ITV, Europol chief Rob Wainwright said the whole world is facing an "escalating threat," warning people that the numbers are going up and that they should ensure the security of their systems is up to date.Above map is showing the WannaCry ransomware infection in just 24 hours.This story is still updating, stay tuned to our Twitter page for more up-to-date information.</s>London — The cyber attack that spread malicious software around the world, shutting down networks at hospitals, banks and government agencies, was thwarted by a young British researcher and an inexpensive domain registration, with help from another 20-something security engineer in the US.

Britain's National Cyber Security Center and others were hailing the cyber security researcher, a 22-year-old identified online only as MalwareTech, who — unintentionally at first — discovered a so-called "kill switch" that halted the unprecedented outbreak.

By then the "ransomware" attack had crippled Britain's hospital network and computer systems in several countries in an effort to extort money from computer users. But the researcher's actions may have saved companies and governments millions of dollars and slowed the outbreak before computers in the US were more widely affected.

MalwareTech is part of a large global cyber security community, working independently or for security companies, who are constantly watching for attacks and working together to stop or prevent them, often sharing information via Twitter. It's not uncommon for them to use aliases, either to protect themselves from retaliatory attacks or for privacy.

In a blog post on Saturday, MalwareTech explained he returned from lunch with a friend on Friday and learned that networks across Britain's health system had been hit by ransomware, tipping him off that "this was something big".

He began analysing a sample of the malicious software and noticed its code included a hidden web address that wasn't registered. He said he "promptly" registered the domain, something he regularly does to try to discover ways to track or stop malicious software.

Across an ocean, Darien Huss, a 28-year-old research engineer for the cyber security firm Proofpoint, was doing his own analysis. The western Michigan resident said he noticed the authors of the malware had left in a feature known as a kill switch. Huss took a screen shot of his discovery and shared it on Twitter.

Soon he and MalwareTech were communicating about what they'd found: That registering the domain name and redirecting the attacks to MalwareTech's server had activated the kill switch, halting the ransomware's infections.

Huss and others were calling MalwareTech a hero on Saturday, with Huss adding that the global cyber security community was working "as a team" to stop the infections from spreading.

"I think the security industry as a whole should be considered heroes," he said.

But he also said he's concerned the authors of the malware could re-release it without a kill switch or with a better one, or that copycats could mimic the attack.

"I think it is concerning that we could definitely see a similar attack occur, maybe in the next 24 to 48 hours or maybe in the next week or two," Huss said. "It could be very possible."

Who perpetrated this wave of attacks remains unknown. Two security firms — Kaspersky Lab and Avast — said they identified the malicious software in more than 70 countries. Both said Russia was hit hardest.

These hackers "have caused enormous amounts of disruption— probably the biggest ransomware cyber attack in history," said Graham Cluley, a veteran of the anti-virus industry in Oxford, England.

This is already believed to be the biggest online extortion attack ever recorded, disrupting services in nations as diverse as the US, Russia, Ukraine, Brazil, Spain and India. Europol, the European Union's police agency, said the onslaught was at "an unprecedented level and will require a complex international investigation to identify the culprits."

In Russia, government agencies insisted that all attacks had been resolved. Russian Interior Ministry, which runs the national police, said the problem had been "localised" with no information compromised. Russia's health ministry said its attacks were "effectively repelled."

The ransomware exploits a vulnerability in Microsoft Windows that was purportedly identified by the US National Security Agency for its own intelligence-gathering purposes. Hackers said they stole the tools from the NSA and dumped them on the internet.</s>A security researcher may have helped stop the spread of the ransomware, which hit tens of thousands of PCs worldwide

Friday’s unprecedented ransomware attack may have stopped spreading to new machines -- at least briefly -- thanks to a "kill switch" that a security researcher has activated.

The ransomware, called Wana Decryptor or WannaCry, has been found infecting machines across the globe. It works by exploiting a Windows vulnerability that the U.S. National Security Agency may have used for spying.

The malware encrypts data on a PC and shows users a note demanding $300 in bitcoin to have their data decrypted. Images of the ransom note have been circulating on Twitter. Security experts have detected tens of thousands of attacks, apparently spreading over LANs and the internet like a computer worm.

However, the ransomware also contains a kill switch that may have backfired on its developers, according to security researchers.

Wana Decryptor infects systems through a malicious program that first tries to connect to an unregistered web domain. The kill switch appears to work like this: If the malicious program can’t connect to the domain, it’ll proceed with the infection. If the connection succeeds, the program will stop the attack.

A security researcher who goes by the name MalwareTech found that he could activate the kill switch by registering the web domain and posting a page on it.

MalwareTech's original intention was to track the ransomware's spread through the domain it was contacting. “It came to light that a side effect of us registering the domain stopped the spread of the infection,” he said in an email.

Security firm Malwarebytes and Cisco’s Talos security group reported the same findings and said new ransomware infections appear to have slowed since the kill switch was activated.

However, Malwarebytes researcher Jerome Segura said it’s too early to tell whether the kill switch will stop the Wana Decryptor attack for good. He warned that other versions of the same ransomware strain may be out there that have fixed the kill-switch problem or are configured to contact another web domain.

Unfortunately, computers already infected with Wana Decryptor will remain infected, he said.

Friday’s ransomware attack first spread through a massive email phishing campaign. At least some of those emails appeared to be messages from a bank about a money transfer, according to Cisco’s Talos group.

Victims who opened the attachment in the email were served with the ransomware, which takes over the computer, security researchers said.

The Wana Decryptor itself is no different from other typical ransomware strains. Once it infects the PC, it’ll encrypt all the files on the machine, and then demand the victim pay a ransom to free them.</s>Amid a desperate situation on Friday in which hundred of thousands of ransomware attacks pelted computers in nearly 100 countries, one stroke of good fortune hit, too. As the malware analysis expert who calls himself MalwareTech rushed to examine the so-called WannaCry strain, he stumbled on a way to stop it from locking computers and slow its spread. All it took was ten bucks, and a little luck.

WannaCry swept Europe and Asia quickly yesterday, locking up critical systems like the UK’s National Health Service, a large telecom in Spain, and other businesses and institutions around the world, all in record time. Once infected, a victim’s computer denies access, and instead displays a message that demands the equivalent of around $300 in bitcoin.

While many thousands have had their lives impacted—including countless people in need of medical care in the UK—two things have slowed WannaCry’s spread. First, Microsoft released a rare emergency patch to help protect Windows XP devices from its reach. (The company hasn’t officially supported XP since 2014.) That helps the many aging systems with no security resource get ahead of infection, if they can download the patch before WannaCry hits. The other, though, was MalwareTech’s happy accident.

As he worked to reverse-engineer samples of WannaCry on Friday, MalwareTech discovered that the ransomware’s programmers had built it to check whether a certain gibberish URL led to a live web page. Curious why the ransomware would look for that domain, MalwareTech registered it himself. As it turns out, that $10.69 investment was enough to shut the whole thing down—for now, at least.

It turned out that as long as the domain was unregistered and inactive, the query had no effect on the ransomware’s spread. But once the ransomware checked the URL and found it active, it shut down.

There are competing theories as to why WannaCry’s perpetrators built it this way. One possibility: The functionality was put in place as an intentional kill switch, in case the creators ever wanted to rein in the monster they’d created. “Based on the behavior implemented in the code, the kill switch was most likely intentional,” says Darien Huss, senior security research engineer at the security intelligence firm Proofpoint, who was working on real-time WannaCry analysis and mitigation on Friday.

MalwareTech theorizes that hackers could have included the feature to shield the ransomware from analysis by security professionals. That sort of examination often takes place in a controlled environment called a “sandbox.” Researchers construct some of these environments to trick malware into thinking it’s querying outside servers, even though it’s really talking to a bunch of dummy sandbox IP addresses. As a result, any address the malware tries to reach gets a response—even if the actual domain is unregistered. Since the domain MalwareTech acquired was supposed to be dormant but went live, WannaCry may have assumed it was in the middle of forensic analysis, and shut down.

Building anti-analysis defenses into malware is common, but the WannaCry hackers appear to have botched the implementation. By relying on a static, discoverable address, whoever found it—in this case MalwareTech—could just register the domain and trigger WannaCry’s shutdown defense.

“It was all pretty shocking, really,” MalwareTech says. The kill switch “was supposed to work like that, just the domain should [have been] random so people can’t register it.”

The kill switch doesn’t help devices WannaCry has already infected and locked down. But by registering the domain, and then directing the traffic to it into a server environment meant to capture and hold malicious traffic—known as a “sinkhole”—MalwareTech bought time for systems that hadn’t already been infected to be patched for long-term protection, particularly in the United States where WannaCry was slower to proliferate because its spread had mostly been in Europe and Asia early on.

“Thankfully MalwareTech already had infrastructure in place for the sinkhole,” Huss says. “If someone had sinkholed the domain and had not been prepared then we would be seeing many more infections right now.” If the setup doesn’t have those enough server space and bandwidth, the malware wouldn’t consistently become trapped and, in this case anyway, self-destruct.

With so many security analysts working to reverse-engineer and observe WannaCry, someone else would have eventually found the valuable mechanism MalwareTech spotted. But when infections are spreading as quickly as they were on Friday, every minute counts.

The discovery doesn’t amount to a permanent fix. All it would take to get around it would be a new strain of WannaCry whose code excludes the kill switch, or relies on a more sophisticated URL generator instead of a static address. And the more fundamental problem of vulnerable devices, particularly Windows XP devices, remains. Still, MalwareTech’s find helped turn a bad situation around—and saved people a lot of bitcoin in the process.</s>Remember that "kill switch" which shut down the WannCry ransomware? An anonymous reader quotes Motherboard:</s>New study: Smokers who switch to e-cigarettes reduce exposure to cancer
Shortly after the attack began a researcher found an effective kill switch, which prevented many new infections, and allowed time to patch systems. This greatly slowed the spread. Cyber security authorities discover new versions that lack the kill switch.