NSA Software Behind Latest Global Ransomware Attack

"It's like WannaCry all over again," said Mikko Hypponen, chief research officer with Helsinki's cybersecurity firm F-Secure, when discussing today's latest outbreak of the WannaCry-like ransomeware attack, which as we reported earlier started in Ukraine, and has since spread to corporate systems across the world, affecting Russian state oil giant Rosneft, the international shipping and energy conglomerate Maersk, and the UK public relations company WPP, before jumping across the Atlantic and going global, by infecting the US-based division of global pharma giant Merck, which this morning confirmed it has been hit by the "Petya" attack.

“We confirm our company’s computer network was compromised today as part of global hack,” Merck said in a statement on Tuesday. “Other organizations have also been affected. We are investigating the matter and will provide additional information as we learn more.”

Merck employees were instructed to disconnect all mobile devices from the company network and advised not to speak to reporters or post messages on social media accounts.

Computers at Merck facilities in Pennsylvania and New Jersey locked up Tuesday morning around 8am local time, according to the Inquirer.

Back in mid-May, when WannaCry spread with tremendous speed around the globe, many said that it's only a matter of time before the virus returns in a more advanced, weaponized version. Sure enough, cyber security experts quoted by Reuters said those behind the attack appeared to have exploited the same hacking tool used in the WannaCry ransomware attack that infected hundreds of thousands of computers in May before a British researcher created a temporary kill-switch.

Hypponen said he expected the outbreak to spread in the Americas as workers turned on vulnerable machines, allowing the virus to attack. "This could hit the U.S.A. pretty bad," he said. And, as Merck confirmed, it already has.

Within hours of the first attack, the U.S. Department of Homeland Security said it was monitoring reports of cyber attacks around the world and coordinating with other countries.

The first reports of organizations being hit emerged from Russia and Ukraine, but the impact quickly spread westwards to computers in Romania, the Netherlands, Norway, and Britain.

Within hours, the attack had gone global.

In addition to the US, a Swiss government agency also reported computer systems were affected in India, though the country's cyber security agency said it had yet to receive any reports of attacks according to Reuters.

For those infected, there may be just one option: pay the ransom. One victims of the cyber attack, a Ukrainian media company, said its computers were blocked and it had a demand for $300 worth of the Bitcoin crypto-currency to restore access to its files.

"If you see this text, then your files are no longer accessible, because they have been encrypted. Perhaps you are busy looking for a way to recover your files, but don't waste your time. Nobody can recover your files without our decryption service," the message said, according to a screenshot posted by Ukraine's Channel 24. The same message appeared on computers at Maersk offices in Rotterdam and at businesses affected in Norway.

Other companies that said they had been hit by a cyber attack included Russian oil producer Rosneft, French construction materials firm Saint Gobain and the world's biggest advertising agency, WPP - though it was not clear if their problems were caused by the same virus. "The building has come to a standstill. It's fine, we've just had to switch everything off," said one WPP employee who asked not to be named.

The virus was seen on various Ukraine ATMs, leading to jokes that while normally you ask ATMs for money, in hacked Ukraine, ATMs ask you.


Cyber security firms scrambled to understand the scope and impact of the attacks, seeking to confirm suspicions hackers had leveraged the same type of hacking tool exploited by WannaCry, and to identify ways to stop the onslaught. Experts said the latest ransomware attacks unfolding worldwide, dubbed GoldenEye, were a variant of an existing ransomware family called Petya.

It uses two layers of encryption which have frustrated efforts by researchers to break the code, according to Romanian security firm Bitdefender. "There is no workaround to help victims retrieve the decryption keys from the computer," the company said.

Russian security software maker Kaspersky Lab, however, said its preliminary findings suggested the virus was not a variant of Petya but a new ransomware not seen before

As noted earlier, Ukraine was quick to accuse Russia. An advisor to Ukraine's interior minister said the virus got into computer systems via "phishing" emails written in Russian and Ukrainian designed to lure employees into opening them. According to the state security agency, the emails contained infected Word documents or PDF files as attachments.

But whatever the origin of the geographic hacking operation, the actual software used is the same that was created by the NSA and subsequently leaked by a disgruntled non-Russian employee. Now we are just waiting for the confirmation.

As a reminder, the quick proliferation of the original WannCry malware, which infected nearly 300,000 computers worldwide within a day, was due entirely to its use of two powerful software exploits that were released to the public in April by the anonymous hacker group calling itself the Shadow Brokers, which said the exploits were developed by the US National Security Agency (NSA).

On Tuesday, Edward Snowden asked "How many times does @NSAGov's development of digital weapons have to result in harm to civil infrastructure before there is accountability?"

Apparently, not enough.

Meanwhile, governments and so-called experts had laughably come to the conclusion that the North Korean government was behind the original WannaCry attack. We just can't wait for the those same "experts" to again blame this latest global malware attack on Kim and his team of crack blackhats.

Finally, for thnose who want to keep track of how many people have made the ransom payment, there is a twitter for that: there is now a Twitter bot, @petya_payments, that will tweet each time a new ransom payment is made to the bitcoin wallets associated with the Petya attack.


Raffie dasein211 Tue, 06/27/2017 - 14:47 Permalink

The world will go into a digital currency and the cryptos we see today at the building blocks of it.If you referring to PM as real cash then you want the utter destruction of the global economy and ultra high inflation.You sure you want to live in a world where gold is $5k and up? How much will that loaf of bread cost?Ya, would be nice if Pm showed a more realistic price, but so far only places like Venezuela shows the real value of PM, but the whole country has to be in ruin to see it.Be careful what you wish for. 

In reply to by dasein211

Tejano (not verified) Raffie Tue, 06/27/2017 - 22:04 Permalink

I wish that these networks of computers were not so fragile. Episodes like this will only continue to get worse. Why wouldn't they? They will get worse to the point where this technology that your global economy is so dependent on will be seriously degraded.Does anyone think that there will be less malicious activity going forward? That these "attacks" will not continue and worsen until there is a real - not just headline -  effect on the globalist ability to deliver the goods? Who is going to stop them?Disclaimer: all in pm's

In reply to by Raffie

jimijon Tue, 06/27/2017 - 14:30 Permalink

Ah the joys of "Windoze." Here I am safely working away with my Mac, and looking to get back in with my dry powder on GDAX. I'm thinking maybe this weekend. 

a Smudge by an… Duc888 Tue, 06/27/2017 - 17:37 Permalink

You guys have trouble reading, comprehending or both. The Vault7 hacks have tools for both Linux and Apple OSs. Not to mention Solaris, HPvax, BSD, IBM Z systems (and legacy). And your precious phones too. Pretty much everything that runs anything.

Remain in your illusion but don't drag that magic blanket over other people's eyes.

In reply to by Duc888

CRM114 Tue, 06/27/2017 - 14:31 Permalink

I'll bet the NSA could figure out who's doing it.If the USA really wants to be the World's Policeman, they could start with The Dark Side of cyberspace.I don't think anyone would have a problem with that.Maybe the FSB, or Mossad, could be the enforcement arm. ;)

Pigeon TePikoElPozo (not verified) Tue, 06/27/2017 - 14:59 Permalink

That would be THE MOST BRILLIANT terrorist attack. You saw people go ape-shit a couple years back when the EBT went down in Alabama or something? The animals tore apart a Wal-Mart. Not that I feel badly for rent-seeking Wal-Mart. But even if 1/3 of the 47 million on food stamps went off, imagine the chaos. It must hit on the 5th of the month, I think, to be most effective.

In reply to by TePikoElPozo (not verified)

cherry picker Tue, 06/27/2017 - 14:32 Permalink

Dear Billy Gates and ZuckenbergI would like a refund for all you did to help the criminals in government hack our systems, including selling them back doors.What you did was sell out your customers for money.

smacker cherry picker Tue, 06/27/2017 - 15:16 Permalink

A Class Action lawsuit against Micro$oft.It should include their imposition of technical changes to the e-mail system (SMTP & POP3) to allow use of HTML coding in e-mails to replace its original plain text format. HTML introduced a new opening for malware to be spread via e-mail because hackers can imbed auto-executable scripts in an e-mail which run when you open it without the users knowledge. Typically, the script will go off and connect to a malware server somewhere and the rest is history.

In reply to by cherry picker