A massive ransomware campaign appears to have infected a number of organizations around the world.
A program that demands $300 (£230) in Bitcoin has locked down computers in thousands of locations.
There have been reports of infections in more than 70 countries, including the UK, US, China, Russia, Spain, Italy and Taiwan.
Many security researchers are linking the incidents together.
The UK’s National Health Services (NHS) was also hit by a ransomware outbreak on the same day and NHS staff shared screenshots of the WannaCry program.
One cyber security researcher tweeted that he had detected many thousands of cases of the ransomware – known as WannaCry and variants of that name – around the world.
“This is huge,” said Jakub Kroustek at Avast.
Another, at cyber-security firm Kaspersky, said that the ransomware had been spotted cropping up in 74 countries and that the number was still growing.
There were a number of reports that Russia had seen more infections than any other single country.
Several experts monitoring the situation have linked the infections to vulnerabilities released by a group known as The Shadow Brokers, which recently claimed to have dumped hacking tools stolen from the US National Security Agency (NSA).
Microsoft released a patch for the vulnerability in March, but many systems may not have had the update installed.
Some security researchers have pointed out that the infections seem to be deployed via a worm – a program that spreads by itself between computers.
Explaining the global ransomware outbreak
Unlike many other malicious programs, this one has the ability to move around a network by itself. Most others rely on humans to spread by tricking them into clicking on an attachment harboring the attack code.
By contrast, once WannaCry is inside an organization it will hunt down vulnerable machines and infect them too. This perhaps explains why its impact is so public – because large numbers of machines at each victim organization are being compromised.
Bitcoin wallets seemingly associated with the ransomware were reported to have already started filling up with cash.
‘Spreading fast’
Another firm that confirmed it had been caught out was delivery company FedEx, though it did not clarify in which territories it had been hit.
“Like many other companies, FedEx is experiencing interference with some of our Windows-based systems caused by malware,” it said in a statement.
“We are implementing remediation steps as quickly as possible.”
Portugal Telecom also confirmed it was struck: “But none of our services were affected,” a spokeswoman told the Reuters news agency.
And a spokesman for Megafon, the second largest mobile phone network in Russia confirmed some of its computers had been infected also.
“This is a major cyber attack, impacting organizations across Europe at a scale I’ve never seen before,” said security architect Kevin Beaumont.
According to security firm Check Point, the version of the ransomware that appeared today is a new variant.
“Even so, it’s spreading fast,” said Aatish Pattni, head of threat prevention for northern Europe. BBC
