The ransomware used in Friday’s attack wreaked havoc on organisations including FedEx and Telefónica, as well as the UK’s National Health Service (NHS), where operations were cancelled, X-rays, test results and patient records became unavailable and phones did not work. “I was out having lunch with a friend and got back about 3pm and saw an influx of news articles about the NHS and various UK organisations being hit,” he told the Guardian. The reason which was suggested is that the domain is a “kill switch” in case something goes wrong, but I now believe it to be a badly thought out anti-analysis. The domain cost $10.69 and was immediately registering thousands of connections every second. I contacted Kafeine about this and he linked me to the following freshly posted tweet made by ProofPoint researcher Darien Huss, who stated the opposite (that our registration of the domain had actually stopped the ransomware and prevent the spread). MalwareTech said he preferred to stay anonymous “because it just doesn’t make sense to give out my personal information, obviously we’re working against bad guys and they’re not going to be happy about this.” 
 
 He also said he planned to hold onto the URL, and he and colleagues were collecting the IPs and sending them off to law enforcement agencies so they can notify the infected victims, not all of whom are aware that they have been affected. Microsoft – By realeasing an out of bounds patch for unsupported operating systems such as Windows XP and Server 2003, people now are able to patch rather than having to attempt upgrades to newer system in order to be secured against this worm. Talos wrote a great writeup explaining the code side here, which I’ll elaborate on using Darien’s screenshot.  So finally I’ve found enough time between emails and Skype calls to write up on the crazy events which occurred over Friday, which was supposed to be part of my week off (I made it a total of 4 days without working, so there’s that). In the case of WannaCrypt, step 1, 2 and 3 were all one and the same, I just didn’t know it yet. pic.twitter.com/zs5Td4ovvL — MalwareTech (@MalwareTechBlog) May 12, 2017 
 
 Now one thing that’s important to note is the actual registration of the domain was not on a whim. Russia 
 
 Russian Central Bank: State media agency Tass reported the bank discovered malware bulk emails to banks but detected no compromise of resources. Spain 
 
 Telefónica: Spanish authorities confirmed the Spanish telecom company Telefónica (TEF) was one of the targets, though the attack affected only some computers and did not compromise the security of clients' information. Interior Ministry: The Russian Interior Ministry acknowledged a ransomware attack on its computers, adding that less than 1% of computers were affected.
– The "accidental hero" who inadvertently stopped Friday's massive cyberattack that affected nearly 100 countries is a 22-year-old who lives with his parents, the Guardian reports. The British cybersecurity researcher—who's keeping anonymous to protect himself—found a nonsensical website address in the code for the ransomware holding victims' data hostage and causing chaos around the globe. He spent less than $11 to register the domain with the hope of monitoring the spread of the ransomware. But it turns out, registering the domain was a "kill switch" added by the creators of the ransomware in case they ever wanted to stop it themselves. For a more in-depth explanation, check out the 22-year-old's blog titled "How to Accidentally Stop a Global Cyber Attack." But while the spread of the ransomware has been halted for now, the world's computer systems are far from in the clear. Cybersecurity expert Matt Suiche says whoever is behind the attack—their identity is still unknown—can simply update the ransomware and start again. "I'd even say this update probably already happened," he tells ABC News. There were 75,000 individual attacks across 99 countries Friday. CNN runs down the victims, which include FedEx, Nissan, the Russian Central Bank, Britain's National Health Service, and Spain's Telefonica. Most of the attacks were in Russia, Ukraine, and Taiwan.