News Reader.info

Cyber extortionists tricked victims into opening malicious malware attachments to spam emails that seemed to contain invoices, job offers, security warnings and other legitimate files. A

global cyber attack described as unprecedented in scale forced a major European automaker to halt some production lines while hitting schools in China and hospitals in Indonesia on Saturday,

though it appeared to die down a day after its launch. Capitalising on spying tools believed to have been developed by the U.S. National Security Agency, the cyber assault has infected tens

of thousands of computers in nearly 100 countries, with Britain's health system suffering the worst disruptions. Cyber extortionists tricked victims into opening malicious malware

attachments to spam emails that seemed to contain invoices, job offers, security warnings and other legitimate files. Once inside the targeted network, so-called ransomware made use of

recently revealed spy tools to silently infect other out-of-date machines without any human intervention. This, security experts said, marked an unprecedented escalation in the risk of fresh

attacks spreading in the coming days and weeks. The ransomware encrypted data on the computers, demanding payments of $300 to $600 to restore access. Researchers observed some victims

paying via the digital currency bitcoin, though no one knows how much may have been transferred to extortionists because of the largely anonymous nature of such transactions. Researchers

with security software maker Avast said they had observed 126,534 ransomware infections in 99 countries, with Russia, Ukraine and Taiwan the top targets. The hackers, who have not come

forward to claim responsibility or otherwise been identified, took advantage of a worm, or self-spreading malware, by exploiting a piece of NSA spy code known as "Eternal Blue"

that was released last month by a hackers group known as the Shadow Brokers, according to researchers with several private cyber security firms. Renault said it had halted auto production at

several sites including Sandouville in northwestern France and Renault-owned Dacia plants in Romania on Saturday to prevent the spread of ransomware in its systems. Nissan's

manufacturing plant in Sunderland, northeast England, was also affected by the cyber assault though "there has been no major impact on our business", a spokesman for the Japanese

carmaker said.German rail operator Deutsche Bahn said some electronic signs at stations announcing arrivals and departures were infected, with travellers posting pictures showing some

bearing a message demanding a cash payment to restore access. "UNPRECEDENTED" ATTACK EASES Europol's European Cybercrime Centre said it was working closely with country

investigators and private security firms to combat the threat and help victims. "The recent attack is at an unprecedented level and will require a complex international investigation to

identify the culprits," it said in a statement. Some experts said the threat had receded for now, in part because a British-based researcher, who declined to give his name, registered

a domain that he noticed the malware was trying to connect to, and so limited the worm's spread. "We are on a downward slope, the infections are extremely few, because the malware

is not able to connect to the registered domain," said Vikram Thakur, principal research manager at Symantec. "The numbers are extremely low and coming down fast." But the

attackers may yet tweak the code and restart the cycle. The researcher in Britain widely credited with foiling the ransomware's proliferation told Reuters he had not seen any such

tweaks yet, "but they will (happen)." Researchers said the worm deployed in the latest attack, or similar tools released by Shadow Brokers, are likely to be used for fresh assaults

not just with ransomware but other malware to break into firms, seize control of networks and steal data. Finance chiefs from the Group of Seven rich countries were to commit on Saturday to

joining forces to fight the growing threat of international cyber attacks, according to a draft statement of a meeting they are holding in Italy. "Appropriate economy-wide policy

responses are needed," the ministers said in their draft statement, seen by Reuters. HOSPITALS IN FIRING LINE In Asia, some hospitals, schools, universities and other institutions were

affected, though the full extent of the damage is not yet known because it is the weekend. "I believe many companies have not yet noticed," said William Saito, a cyber security

adviser to Japan's government. "Things could likely emerge on Monday" as staff return to work. China's information security watchdog said "a portion" of Windows

systems users in the country were infected, according to a notice posted on the official Weibo page of the Beijing branch of the Public Security Bureau on Saturday. Xinhua state news agency

said some secondary schools and universities were hit. In Vietnam, Vu Ngoc Son, a director of Bkav Anti Malware, said dozens of cases of infection had been reported there, but he declined

to identify any of the victims. South Korea's Yonhap news agency reported a university hospital had been affected, while a communications official in Indonesia said two hospitals there

had been hit. The most disruptive attacks were reported in Britain, where hospitals and clinics were forced to turn away patients after losing access to computers on Friday. International

shipper FedEx Corp said some of its Windows computers were also breached. "We are implementing remediation steps as quickly as possible," a FedEx statement said. Telecommunications

company Telefonica was among many targets in Spain. Portugal Telecom and Telefonica Argentina both said they were also targeted. Only a small number of U.S.-headquartered organisations were

hit because the hackers appear to have begun the campaign by focusing on targets in Europe, said Thakur. By the time they turned their attention to the United States, spam filters had

identified the new threat and flagged the ransomware-laden emails as malicious, he added. MICROSOFT BOLSTERS WINDOWS DEFENCES Private security firms identified the ransomware as a new

variant of "WannaCry" that had the ability to automatically spread across large networks by exploiting a known bug in Microsoft's Windows operating system. "This is one

of the largest global ransomware attacks the cyber community has ever seen," said Rich Barger, director of threat research with Splunk, one of the firms that linked WannaCry to the NSA.

The Shadow Brokers released Eternal Blue as part of a trove of hacking tools that they said belonged to the U.S. spy agency. The attack targeted Windows computers that had not installed

patches released by Microsoft in March, or older machines running software that Microsoft no longer supports and for which patches did not exist, including the 16-year-old Windows XP system,

researchers said. Microsoft said it pushed out automatic Windows updates to defend existing clients from WannaCry. It had issued a patch on March 14 to protect them from Eternal Blue. Late

on Friday, Microsoft also released patches for a range of long discontinued software, including Windows XP and Windows Server 2003. "Today our engineers added detection and protection

against new malicious software known as Ransom:Win32.WannaCrypt," Microsoft said in a statement on Friday, adding it was working with customers to provide additional assistance.

POLITICALLY SENSITIVE TIMING The spread of the ransomware capped a week of cyber turmoil in Europe that began when hackers posted a trove of campaign documents tied to French candidate

Emmanuel Macron just before a run-off vote in which he was elected president of France. On Wednesday, hackers disrupted the websites of several French media companies and aerospace giant

Airbus. The hack happened four weeks before a British general election in which national security and the management of the state-run National Health Service are important issues.

Authorities in Britain have been braced for cyber attacks in the run-up to the election, as happened during last year's U.S. election and on the eve of the French run-off vote on May 7.

But those attacks - blamed on Russia, which has repeatedly denied them - followed a different modus operandi involving penetrating the accounts of individuals and political organisations

and then releasing hacked material online. On Friday, Russia's interior and emergencies ministries, as well as its biggest bank, Sberbank, said they were targeted by ransomware. The

interior ministry said about 1,000 computers had been infected but it had localised the virus. Although cyber extortion cases have been rising for several years, they have to date affected

small- to mid-sized organisations. "Seeing a large telco like Telefonica get hit is going to get everybody worried," said Chris Wysopal, chief technology officer with cyber

security firm Veracode. (Additional reporting by Kiyoshi Takenaka, Jim Finkle, Eric Auchard, Jose Rodriguez, Alistair Smout, Andrea Shalal, Jack Stubbs, Antonella Cinelli, Dustin Volz, Kate

Holton, Andy Bruce, Michael Holden, David Milliken, Rosalba O'Brien, Julien Toyer, Tim Hepher, Luiza Ilie, Patricia Rua, Axel Bugge, Sabine Siebold and Eric Walsh, Engen Tham, Fransiska

Nangoy, Soyoung Kim, Mai Nguyen; editing by Mark Heinrich) (This article has not been edited by DNA's editorial team and is auto-generated from an agency feed.)