Monday Monday Miller

Wannacrypt hit China; Microsoft compares what happened to the theft

On Friday, May 12, tens of thousands of computers around the world were blocked by the Wannacrypt virus. The most difficult thing turned out to be the UK, where the virus infected computers in hospitals, and Russia (suffered at least the Ministry of Internal Affairs and Megafon salons). At the weekend, the situation calmed down, but experts warned: on Monday, a new wave can begin. Medusa says what happened on May 15 and the day before.

The ransomware virus hit China. Experts noted that the virus began to actively block computers when there was already evening in Asia - and many employees managed to turn off computers and go home. On Monday, Wannacrypt continued: 40 thousand organizations were infected in China alone, including four thousand scientific ones. The local number of infected computers is assessed by the local information protection company at hundreds of thousands.

In addition, at the weekend, the virus struck the computers of the state oil and gas company Petrochina-because of this, electronic payments did not work at a number of refueling. The virus was also found in South Korea, Taiwan, India and Australia. In Japan, two thousand computers of 600 different places are infected; Among the victims are Nissan and Hitachi. One infection occurred in New Zealand.

There are already 200 thousand infected computers in the world, the Europol reported . The virus is found on computers of 150 countries. The attackers transferred more than 50 thousand dollars to the bitcoin purses (usually the virus requires 300 dollars from each victim).

The virus was suspended by a meaningless domain. It helped for a short while. On Saturday, an anonymous security specialist, leading Twitter @malwareTechblog, was able to suspend the spread of Wannacrypt, simply registering a meaningless domain. It turned out that the virus checked the existence of this domain, and if the request was successful, stopped activity. The next day, an updated version of the malicious program appeared , which no longer addresses the domain.

Microsoft: The situation is similar to the theft of Tomagavs. On May 14, Corporation President Brad Smith published a letter in which he criticized the authorities for the habit of not revealing the vulnerabilities they found - and Wannacrypt used the “hole” in Windows, which was known to the USA in the USA; It became publicly known about her thanks to hackers from The Shadow Brokers group. Smith directly compares the consequences of this leak with the consequences of the potential theft of Tomagavk cruise missiles among the US authorities.

Vladimir Putin: The virus did not cause significant damage to Russian institutions. The Presidentsaid that Russia is not related to the creation of Wannacrypt: “They said that the primary source of this virus is the United States special services, Russia has nothing to do with it.”

There is no way to restore the data encrypted by the virus yet. The victims are advised not to pay attackers and try to restore data from reserve copies, or wait until the resident program comes out. There are already several programs on the Web, the authors of which promise to return the information - but only if you are lucky and the virus did not have time to delete unnecessed version of files. Important: we did not experience these programs and cannot guarantee that they will not cause additional harm to the computer.

Sultan Suleimanov