Errymath: WannaCry

Free WannaCry decryption tools released online

The private cybersecurity industry has faced a series of 
unprecedented global crises so far in 2017, including WannaCry and 
Adylkuzz malware attacks. In the face of such rampant digital crime, a 
viable open source counter-hacking community is emerging.

</div>
<div class="article__tags-trends">
<div class="tags-trends">
<strong class="tags-trends__heading"><br /></strong></div>
</div>
Adrien Guinet, a French security researcher from <a href="https://www.quarkslab.com/">Quarkslab</a>, discovered a method for finding the ransomware’s decryption key.<br />
WannaCry encryption creates two keys – <em>“public”</em> and <em>“private”</em> – that are based on prime numbers and are responsible for encrypting and decrypting the system’s files respectively.<br />
However, WannaCry <em>"does not erase the prime numbers from memory before freeing the associated memory,"</em> Guinet said, as cited by <a href="https://thehackernews.com/2017/05/wannacry-ransomware-decryption-tool.html?m=1">The Hacker News</a>.<br />
The aptly-named “<em>WannaKey”</em> tool is available for free <a href="https://github.com/aguinet/wannakey">here</a> but only functions on computers running the Windows XP operating system.<br />
<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">I got to finish the full decryption process, but I confirm that, in this case, the private key can recovered on an XP system <a href="https://twitter.com/hashtag/wannacry?src=hash">#wannacry</a>!! <a href="https://t.co/QiB3Q1NYpS">pic.twitter.com/QiB3Q1NYpS</a></p>— Adrien Guinet (@adriengnt) <a href="https://twitter.com/adriengnt/status/865168794586632192">May 18, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr"><a href="https://twitter.com/hashtag/WannaCry?src=hash">#WannaCry</a> Ransomware Decryption Tool Released; Unlock Your Files Without Paying Ransom <a href="https://t.co/TZnU3sSxfb">https://t.co/TZnU3sSxfb</a> <a href="https://twitter.com/hashtag/security?src=hash">#security</a> <a href="https://twitter.com/hashtag/wanakiwi?src=hash">#wanakiwi</a> <a href="https://t.co/vJ3wmhDXaw">pic.twitter.com/vJ3wmhDXaw</a></p>— The Hacker News (@TheHackersNews) <a href="https://twitter.com/TheHackersNews/status/865480077647069184">May 19, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>
<br />
Given the very specific way in which the tool works, it only 
functions if the infected computer has not been rebooted since the 
WannaCry ransomware and the associated memory has not been allocated and
 erased by another process.<br />
In yet another win for open source 
online collaboration by private cybersecurity firms and researchers, 
another tool was quickly developed based on Guinet’s findings that has 
broader applications.<br />
<br />
Benjamin Delpy developed the WanaKiwi tool, available for free download <a href="https://github.com/gentilkiwi/wanakiwi/releases">here</a>,
 which simplifies the decryption process somewhat and is applicable to 
infected computers that run the Windows XP, Windows 7, Windows Vista, 
Windows Server 2003 and 2008 operating systems.<br />

<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">Almost all WannaCry victims were running Windows 7 <a href="https://t.co/wEVgoyUmhV">https://t.co/wEVgoyUmhV</a> <a href="https://t.co/bVw3LLk4Z9">pic.twitter.com/bVw3LLk4Z9</a></p>— The Verge (@verge) <a href="https://twitter.com/verge/status/865626404385193984">May 19, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>
<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">Nearly all <a href="https://twitter.com/hashtag/WannaCry?src=hash">#WannaCry</a> victims were running Windows 7, according to security firm <a href="https://twitter.com/kaspersky">@Kaspersky</a> Lab <a href="https://t.co/q0qbVuU7YV">https://t.co/q0qbVuU7YV</a> <a href="https://t.co/aJropxn7V2">pic.twitter.com/aJropxn7V2</a></p>— CNET (@CNET) <a href="https://twitter.com/CNET/status/865693552537456643">May 19, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>
<br />
<iframe width="660" height="460" src="https://www.youtube.com/embed/PGg2th0wSVY" frameborder="0" allowfullscreen></iframe>
<br />
<br />
<div class="rtcode">
<center>
</center>
</div>
Comae Technologies founder and CEO Matt Suiche has also provided a <a href="https://blog.comae.io/wannacry-decrypting-files-with-wanakiwi-demo-86bafb81112d">series</a> of blogs and demonstrations on how to use WanaKiwi to decrypt your files.<br />
<br />
While both WannaKey and WanaKiwi are limited in what they can accomplish
 for victims of the cyberattack that affected hundreds of thousands of 
computers across the globe, this can still be seen as a major win for 
open source counter-hacking.<br />
<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr"><a href="https://twitter.com/hashtag/Wannacry?src=hash">#Wannacry</a> decrypting files tested by <a href="https://twitter.com/EC3Europol">@EC3Europol</a> & found to recover data in some circumstances: <a href="https://t.co/E9j59j4p0c">https://t.co/E9j59j4p0c</a> <a href="https://t.co/3n8hd4hrQi">https://t.co/3n8hd4hrQi</a></p>— Europol (@Europol) <a href="https://twitter.com/Europol/status/865604532419543041">May 19, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>
<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr"><a href="https://twitter.com/hashtag/WannaCry?src=hash">#WannaCry</a> <a href="https://twitter.com/hashtag/Ransomware?src=hash">#Ransomware</a> Answers to your main questions & prevention advice: <a href="https://t.co/8xbDNrdeNt">https://t.co/8xbDNrdeNt</a> <a href="https://t.co/f5tpBcTOBr">pic.twitter.com/f5tpBcTOBr</a></p>— Europol (@Europol) <a href="https://twitter.com/Europol/status/865486771894734849">May 19, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>
<br />
<br /></div>

Free WannaCry decryption tools released online

The private cybersecurity industry has faced a series of unprecedented global crises so far in 2017, including WannaCry and A...

WannaCry XXL? 2nd even bigger global cyber attack already underway

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEidArY3CMwFszH6C_b_fumaYQmx1WbA9NP0nlWKSFiiYH2f-2EhFZ07VkiU139t9EQAxFqaYjLiqyAq4XJJOe_-RBObaDPtbWR1SdmM_4_C1lFxJsvaSlEoUKVUuDGC4zMkkC_nfEilPrs/s1600/40428CEC00000578-4501220-image-a-1_1494660354407.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="436" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEidArY3CMwFszH6C_b_fumaYQmx1WbA9NP0nlWKSFiiYH2f-2EhFZ07VkiU139t9EQAxFqaYjLiqyAq4XJJOe_-RBObaDPtbWR1SdmM_4_C1lFxJsvaSlEoUKVUuDGC4zMkkC_nfEilPrs/s640/40428CEC00000578-4501220-image-a-1_1494660354407.jpg" width="640" /></a></div>
    A US official on Tuesday put the number of computers infected by WannaCry at over 300,000.<br />
<br />
The Shadow Brokers hacking group is responsible for the release of the National Security 
Agency’s (NSA) hacking exploits which highlighted a Windows 
vulnerability used by hackers in the recent WannaCry global ransomware 
attack.<br />
<br />
The worm, known variously as WannaCry, WanaCryptor, and WannaCrypt, 
targets computers running Microsoft operating systems. It is built on an
 exploit named <a class="linkTargets-processed external" href="https://arstechnica.com/security/2017/04/nsa-leaking-shadow-brokers-just-dumped-its-most-damaging-release-yet/" target="_blank">EternalBlue</a>, one of many NSA “cyber-weapons” released by a group known as the Shadow Brokers, who first started leaking NSA <a class="linkTargets-processed" href="http://www.popsci.com/who-hacked-nsa">tools late last summer</a>.<b>  </b><br />
<br />
It isn’t clear where the Shadow Brokers got the NSA 
hacking tools, but the arrest of former NSA contractor Harold T. Martin 
III last August for stealing a massive amount of data has made him the 
most likely suspect.<br />
<b></b><br />
<b></b>
Former NSA officials have claimed the Shadow Brokers’ tools are <i>“identical”</i> to those taken by Martin, <a href="https://www.washingtonpost.com/business/technology/nsa-officials-worried-about-the-day-its-potent-hacking-tool-would-get-loose-then-it-did/2017/05/16/50670b16-3978-11e7-a058-ddbb23c75d82_story.html?utm_term=.ef445aea4ca9">reports</a> The Washington Post.<br />
The US government said it seized <a href="https://www.forbes.com/forbes/welcome/?toURL=https://www.forbes.com/sites/thomasbrewster/2016/10/20/feds-seized-50tb-of-data-and-arsenal-of-guns-from-accused-nsa-thief/&refURL=https://www.google.ie/&referrer=https://www.google.ie/">50</a>
 terabytes of confidential data from Martin’s home which was stolen from
 the NSA and other intelligence agencies. A veteran contractor, Martin 
had access to classified information as part of his work in the 
intelligence-gathering division of the NSA named Tailored Access 
Operations.<br />
He has been in custody since his arrest and is facing espionage charges.
 Another NSA employee was also arrested in 2015, but no information has 
been released about the individual.<br />
<blockquote class="twitter-tweet" data-lang="en">
<div dir="ltr" lang="en">
The exploits leaked by The Shadow Brokers are allegedly identical to those stolen by former contractor Harold Martin <a href="https://t.co/TUeEXh4eKV">https://t.co/TUeEXh4eKV</a> <a href="https://t.co/w7W5uExiQC">pic.twitter.com/w7W5uExiQC</a></div>
— Joseph Cox (@josephfcox) <a href="https://twitter.com/josephfcox/status/864776395364466688">May 17, 2017</a></blockquote>
<script async="" charset="utf-8" src="//platform.twitter.com/widgets.js"></script>

<blockquote class="twitter-tweet" data-lang="en">
<div dir="ltr" lang="en">
"We are tracking over 110 different ransom Trojan gangs. This is just one of them."<br />
- <a href="https://twitter.com/mikko">@Mikko</a> on <a href="https://twitter.com/hashtag/WannaCry?src=hash">#WannaCry</a> <a href="https://t.co/KlEL8Q5j9P">https://t.co/KlEL8Q5j9P</a> <a href="https://twitter.com/hashtag/nscnn?src=hash">#nscnn</a></div>
— Kristie Lu Stout ✌🏽 (@klustout) <a href="https://twitter.com/klustout/status/864796841396682752">May 17, 2017</a></blockquote>
<br />
<script async="" charset="utf-8" src="//platform.twitter.com/widgets.js"></script>

<img alt="The EternalBlue code formed the basis of the WannaCry ransomware, which struck networks on Friday in one of the biggest cyberattacks ever recorded" class="blkBorder img-share b-loaded" height="416" id="i-8f9329d71c191d6d" src="http://i.dailymail.co.uk/i/pix/2017/05/17/13/4025615900000578-4514530-image-a-59_1495024844789.jpg" width="640" /><br />
The EternalBlue code formed the basis of the WannaCry ransomware, which 
struck networks on Friday in one of the biggest cyberattacks ever 
recorded<br />
<br />
<div style="background-color: white; border: medium none; color: black; overflow: hidden; text-align: left; text-decoration: none;">
<b>It spread without exploiting user interactions.</b><br />
Unlike phishing
 or spearphishing attacks, where a computer is compromised because a 
user clicks a link in a targeted email, WannaCry works without 
exploiting any human error.<br />
<br />
Kaspersky Lab, a well-known cybersecurity company, wrote in <a class="linkTargets-processed external" href="https://securelist.com/blog/research/78411/wannacry-faq-what-you-need-to-know-today/" target="_blank">a richly detailed FAQ about the attack</a>
 that “Perhaps the main reason why Wannacry was so successful is the 
fact that the EternalBlue exploit works over the Internet without 
requiring any user interaction." Because it strikes over networks, it 
can still wreak havoc inside a local network even with the killswitch 
active, as the killswitch needs the internet to work.</div>
<br />
<b>Kaspersky recommendations:
</b><br />
<ul>
<li>Install the MS Security Bulletin patches for <a href="https://technet.microsoft.com/en-us/library/security/ms17-010.aspx" target="_blank">MS17-010</a>. Please note 
that Microsoft also released an emergency patch for Windows XP, which is
 out of support!</li>
<li>Disable SMBv1.</li>
<li>Backup your data on a regular basis and be sure to store the backups offline.</li>
<li>Limit administrative privileges in the network.</li>
<li>Segment your network.</li>
<li>Make sure all nodes have security software installed and updated.</li>
<li>Kaspersky users: make sure System Watcher is enabled and the 
software updated. System watcher will ensure rollback of any encrypted 
files.</li>
<li>For those who do not use Kaspersky Lab solutions, we suggest installing the free <a href="https://go.kaspersky.com/Anti-ransomware-tool_soc.html?utm_source=smm_sl&utm_medium=ww_sl_o_170515" target="_blank">Kaspersky Anti-Ransomware Tool for business</a> (KART).</li>
<li>WannaCry is also targeting embedded systems. We recommend ensuring that <a href="https://www.kaspersky.com/enterprise-security/embedded-systems" target="_blank">dedicated security solutions</a> for embedded systems are installed, and that they have both anti-malware protection and Default Deny functionality enabled. </li>
</ul>
<br />
<i><b>An Evil Lair?</b></i><br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><img alt="" class="aligncenter size-full wp-image-78422" height="384" src="https://cdn.securelist.com/files/2017/05/wannacry_faq_05.png" style="margin-left: auto; margin-right: auto;" width="640" /></td></tr>
<tr align="left"><td class="tr-caption"><span style="font-size: small;">Unlikely the attackers will be able to do anything with the bitcoins. Even 
though the wallet owners are anonymous, the transactions are visible to 
everybody and can be tracked. Once the bitcoins reach a payment point, 
where the attackers use them to purchase something in the real world, 
that payment can be tracked to shipment details, services, or other IPs,
 effectively, increasing the chances of getting caught.</span><br />
</td><td class="tr-caption"></td><td class="tr-caption"></td><td class="tr-caption"></td><td class="tr-caption"></td></tr>
</tbody></table>
<br />
<h3 class="article__heading" style="text-align: left;">
</h3>
<h1 class="title single-title entry-title">
<a href="https://phys.org/news/2017-05-large-scale-cyberattack-underway-experts.html" target="_blank"><span style="color: blue;">Adylkuzz</span></a> cyberattack dwarfs WannaCry</h1>
<div class="article__summary summary ">
As the world reels from the WannaCry ransomware attack, it’s <i><b>now
 emerged that a second, potentially larger attack, is already under way</b></i>.
 It seems the widespread proliferation of military-grade cyberweapons 
has ushered in a new era of digital crime.

</div>
<div class="article__tags-trends">
<div class="tags-trends">
<b class="tags-trends__heading"><br /></b></div>
</div>
Cyber
 bandits have again deployed both the EternalBlue and DoublePulsar 
exploits developed and used by the NSA which were released by the 
ShadowBrokers hackers back in April.<br />
<br />
<i>“Initial statistics 
suggest that this attack may be larger in scale than WannaCry, affecting
 hundreds of thousands of PCs and servers worldwide: because this attack
 shuts down SMB networking to prevent further infections with other 
malware (including the WannaCry worm) via that same vulnerability, it 
may have in fact limited the spread of last week's WannaCry infection,” </i><a href="https://www.proofpoint.com/us/threat-insight/post/adylkuzz-cryptocurrency-mining-malware-spreading-for-weeks-via-eternalblue-doublepulsar">wrote</a> a security researcher who goes by the alias Kafeine at cybersecurity company Proofpoint.<br />
<br />
This
 latest attack uses the two exploits to install the cryptocurrency miner
 Adylkuzz over corporate Local Area and wireless networks but, rather 
curiously, may actually have helped slow the spread of WannaCry.<br />
<b><br /></b>
However, in an apparent case of <i>“picking your poison,”</i>
 the Adylkuzz miner dramatically slows PC and server performance as it 
extracts cryptocurrency but it does not lock users out of their machines
 and data, as WannaCry did.<br />
<br />
Researchers at Proofpoint estimate that the Adylkuzz attack may have 
begun as early as April 24 but was subsequently overshadowed in the 
hysteria that followed the WannaCry ransomware attacks.<br />
The attack
 is launched from multiple virtual private servers which scour the 
internet for vulnerabilities to install the Adylkuzz miner.<br />
<br />
<span style="font-size: large;"></span><br />
<img alt="Adylkuzz is believed to have infected more computers than WannaCry, using the same vulnerabilities" height="263" src="https://3c1703fe8d.site.internapcdn.net/newman/csz/news/800/2017/adylkuzzisbe.jpg" width="400" /><br />
Adylkuzz is believed to have infected more computers than<br />
WannaCry, using the same vulnerabilities. <br />
<br />
<span style="font-size: large;"><b>The malware infection occurs as follows:</b></span><br />
The
 EternalBlue exploit opens the door for infection with DoublePulsar on a
 target machine. DoublePulsar then downloads and runs Adylkuzz on the 
computer.<br />
Adylkuzz then stops any preexisting versions of itself 
on a target machine, while also blocking SMB network communications with
 other machines to prevent any further malware infections from 
disrupting its operations. It initially prevents cybersecurity 
professionals from identifying that there is a problem.<br />
Once the 
door has been held open and detection risks have been minimized, 
Adylkuzz then downloads mining instructions, the cryptocurrency miner 
itself and a variety of cleanup tools to mask its activities. <br />
<blockquote class="twitter-tweet" data-lang="en">
<div dir="ltr" lang="en">
<a href="https://twitter.com/hashtag/WannaCry?src=hash">#WannaCry</a> XXL? 2nd even bigger global cyber attack already underway <a href="https://t.co/agSMftskRQ">https://t.co/agSMftskRQ</a> <a href="https://t.co/zjq66mrZBT">pic.twitter.com/zjq66mrZBT</a></div>
— RT (@RT_com) <a href="https://twitter.com/RT_com/status/864949638411030529">May 17, 2017</a></blockquote>
While the term cryptocurrency is typically associated with Bitcoin, Adylkuzz actually mines <a href="https://getmonero.org/home">Monero</a>,
 a similar but more heavily encrypted digital currency. Monero recently 
saw a significant uptick in usage after it was adopted in the AlphaBay market on the Dark Web.<br />
As with other cryptocurrencies, Monero expands in market cap through self-proliferation via digital mining. One monero is <a href="https://coinmarketcap.com/currencies/monero/">roughly equivalent</a> to $27 at <a href="https://www.worldcoinindex.com/coin/monero">current exchange rates</a>.<br />
During
 its research, Proofpoint identified three addresses which had already 
generated $7,000, $14,000 and $22,000 respectively, before being shut 
down.<br />
<br />
To cover their tracks, whoever is behind the attack regularly changes 
the online payment address to avoid attracting too much attention.<br />
As in the case of the WannaCry attack, hackers have leveraged the NSA’s 
weaponized exploits of legacy Microsoft operating systems to infect 
hundreds of thousands of machines worldwide with malware. Since the 
Shadow Brokers’ leak of these NSA exploits there have been two high 
profile attacks with many more expected in the future. <br />
<script async="" charset="utf-8" src="//platform.twitter.com/widgets.js"></script>

<br />
<blockquote class="twitter-tweet" data-lang="en">
<div dir="ltr" lang="en">
The three bitcoin wallets tied to <a href="https://twitter.com/hashtag/WannaCry?src=hash">#WannaCry</a> ransomware have received 273 payments totaling 44.84252902 BTC ($80,802.04 USD).</div>
— actual ransom (@actual_ransom) <a href="https://twitter.com/actual_ransom/status/864994024733716480">May 18, 2017</a></blockquote>
<script async="" charset="utf-8" src="//platform.twitter.com/widgets.js"></script>

<blockquote class="twitter-tweet" data-lang="en">
<div dir="ltr" lang="en">
<a href="https://twitter.com/hashtag/WannaCry?src=hash">#WannaCry</a> ransomware attack: How it works and how to protect yourself... <a href="https://t.co/sg2f9Ua23e">https://t.co/sg2f9Ua23e</a> <a href="https://t.co/K34trlQxjB">pic.twitter.com/K34trlQxjB</a></div>
— Sophos (@Sophos) <a href="https://twitter.com/Sophos/status/864985164375625729">May 17, 2017</a></blockquote>
<script async="" charset="utf-8" src="//platform.twitter.com/widgets.js"></script>
</div>

WannaCry XXL? 2nd even bigger global cyber attack already underway

A US official on Tuesday put the number of computers infected by WannaCry at over 300,000. The Shadow Brokers hacking group is resp...

WannaCry hackers have not withdrawn any ransom bitcoin, surveillance shows

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgA8lxwSh9Rkjg67ZQKsQ9cvcfc64X9H9HkQAxpwjVgboja9qm2eyNSR2V7ZYJN_d87ACoCwxYdFg1YEnvEvrO0BBpdiRcB9zIBG_Hv4ZAQIrCW7xODAn2R1IrxnTDDae5RRDaEkHdgDCw/s1600/5919b5a3c36188846f8b4649.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="354" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgA8lxwSh9Rkjg67ZQKsQ9cvcfc64X9H9HkQAxpwjVgboja9qm2eyNSR2V7ZYJN_d87ACoCwxYdFg1YEnvEvrO0BBpdiRcB9zIBG_Hv4ZAQIrCW7xODAn2R1IrxnTDDae5RRDaEkHdgDCw/s640/5919b5a3c36188846f8b4649.jpg" width="640" /></a></div>
   © Silas Stein / Global Look Press<br />
<br />
<div class="article__summary summary ">
Hackers collecting bitcoin following Friday’s cyberattack have 
not yet withdrawn any of the digital currency from their accounts, and 
could have a hard time doing so without getting caught, experts say.

</div>
<div class="arcticle__read-more read-more">
<div class="read-more__title">
</div>
<span class="read-more__footer"></span>
    
</div>
With the help of leaked software developed by the National 
Security Agency (NSA), malicious ransomware called the Wanna Decryptor –
 or WannaCry – spread to 150 countries until Mei, 15.<br />
<br />
The malware instructs people to pay up to £460 to
 one of three bitcoin addresses in order to retain their files, and also
 displays a countdown clock giving a deadline for the payments.<br />
The
 hackers, who have locked files on 200,000 computers worldwide, have 
only made around $500,000 so far, despite the magnitude of the attack. 
Britain’s National Crime Agency (NCA) is urging victims not to pay the 
ransom.<br />
Nothing has yet been withdrawn from any of the bitcoin 
accounts, and law enforcement agencies watching them say the 
perpetrators could be difficult to trace until they access some of the 
ransom money.<br />
<br />
<img alt="" data-aria-label-part="" src="https://pbs.twimg.com/media/C_4LxnIU0AIZszg.jpg" style="top: -0px; width: 100%;" /><br />
  <img alt="" data-aria-label-part="" src="https://pbs.twimg.com/media/C_4LvFLV0AAQuxF.jpg" style="top: -0px; width: 100%;" /><br />
<br />
Ransomware bounties are usually paid in bitcoin, a digital currency 
that keeps its users anonymous. Bitcoin is also traceable, however, as 
every transaction is tied to publicly-accessible accounts, typically 
called wallets. The wallets show each payment that victims have sent in 
hopes of regaining access to their files.<br />
New payments are coming 
in regularly, according to Ransom Tracker, a Twitter bot that is sending
 out automated messages and posting every time a payment is made to one 
of the three bitcoin addresses.<br />
<blockquote class="twitter-tweet" data-lang="en">
<div dir="ltr" lang="en">
[2017-05-15 14:20:47] Ransom paid to <a href="https://twitter.com/hashtag/WannaCry?src=hash">#WannaCry</a>: 0.18BTC = $314 (<a href="https://t.co/qfSLWet6Dj">https://t.co/qfSLWet6Dj</a>).<br />
WannaCry total: 31.39BTC = $54,140.</div>
— Ransom Tracker (@ransomtracker) <a href="https://twitter.com/ransomtracker/status/864123925122383872">May 15, 2017</a></blockquote>
<script async="" charset="utf-8" src="//platform.twitter.com/widgets.js"></script>
<blockquote class="twitter-tweet" data-lang="en">
<div dir="ltr" lang="en">
What you need to know about <a href="https://twitter.com/hashtag/Bitcoin?src=hash">#Bitcoin</a> after the WannaCry ransomware attack <a href="https://t.co/PGa55BNjXL">https://t.co/PGa55BNjXL</a> <a href="https://t.co/9iDhlF0KaM">pic.twitter.com/9iDhlF0KaM</a></div>
— Bitcoin_Friend (@Bitcoin_Friend) <a href="https://twitter.com/Bitcoin_Friend/status/864250327268077569">May 15, 2017</a></blockquote>
<script async="" charset="utf-8" src="//platform.twitter.com/widgets.js"></script>
<blockquote class="twitter-tweet" data-lang="en">
<div dir="ltr" lang="en">
This is how <a href="https://twitter.com/hashtag/WannaCry?src=hash">#WannaCry</a> is being shown on German television. <a href="https://twitter.com/SwiftOnSecurity">@SwiftOnSecurity</a> <a href="https://twitter.com/hackerfantastic">@hackerfantastic</a> <a href="https://twitter.com/x0r">@x0r</a> <a href="https://twitter.com/lumines">@lumines</a> <a href="https://t.co/v9jOCy8ct6">pic.twitter.com/v9jOCy8ct6</a></div>
— Dennis MH (@D2KX_) <a href="https://twitter.com/D2KX_/status/864140925433511938">May 15, 2017</a></blockquote>
<script async="" charset="utf-8" src="//platform.twitter.com/widgets.js"></script>

Oliver Gower, the deputy director of the NCA’s national cybercrime unit, has vowed to track down the hackers.<br />
<i>“Cybercriminals may believe they are anonymous but we will use all the tools at our disposal to bring them to justice,”</i> he told the Times.<br />
<br />
Rob
 Wainwright, the director of Europol, told the newspaper that security 
officials believe the hack is the work of criminals, rather than a 
state-sponsored attack.<br />
<i>“Our working assumption, as with every
 other major ransomware attack, is that this is a cybercriminal attack. 
Unless we have something definitive to point us in another direction 
that’s our assumption at the moment. As in any investigation, we keep 
our mind open.”</i><br />
<br />
Public awareness is <i>“absolutely critical for preventing cyberattacks,”</i> Neil Walsh, the head of the Global Program on Cybercrime launched by the UN Office on Drugs and Crime (UNODC), told. <i>“Such
 threats could theoretically be averted if the public is aware of what a
 cyberattack looks like and is [cautious] with opening emails and 
especially emails with attachments that they were not expecting to get,”</i> he said.<br />
At the same time, he warned that the WannaCry ransomware could potentially <i>“propagate further”</i> as people around the world got back to work Monday. <br />
<blockquote class="twitter-tweet" data-lang="en">
<div dir="ltr" lang="en">
People still refuse to accept the sad truth <a href="https://twitter.com/hashtag/WannaCry?src=hash">#WannaCry</a> <a href="https://t.co/NviBJcozm5">pic.twitter.com/NviBJcozm5</a></div>
— Florian Roth (@cyb3rops) <a href="https://twitter.com/cyb3rops/status/864223978906365952">May 15, 2017</a></blockquote>
<script async="" charset="utf-8" src="//platform.twitter.com/widgets.js"></script>
<blockquote class="twitter-tweet" data-lang="en">
<div dir="ltr" lang="en">
VIDEO: More than 200,000 victims in 150 countries have been the target of a cyber attack called <a href="https://twitter.com/hashtag/ransomware?src=hash">#ransomware</a>. <a href="https://twitter.com/hashtag/WannaCry?src=hash">#WannaCry</a> <a href="https://t.co/qLh8OFTMdp">pic.twitter.com/qLh8OFTMdp</a></div>
— dwnews (@dwnews) <a href="https://twitter.com/dwnews/status/864208531385270272">May 15, 2017</a></blockquote>
<i>“A
 challenge with any ransomware or cyberattack is that when people come 
back to work they turn on potentially insecure systems, which are not 
updated with the latest security patches. Perhaps, they are unaware of 
how this threat arises through email or opening attachments,”</i> Walsh said.<br />
He went on to call on all countries to join their efforts in combating cyberthreats <i>“irrespective of politics and politicizing.”</i> He also urged the governments to <i>“use
 law enforcement channels such as Interpol, Europol and bilateral 
cooperation as well as to work together politically to help to mitigate 
these threats.”</i><br />
<br />
On Sunday, Europol Director Rob Wainwright 
told the ITV network that the cyberattack that began on Friday has hit 
some 200,000 victims in over 150 countries so far.<br />
<i>“The global
 reach is unprecedented. The latest count is over 200,000 victims in at 
least 150 countries, and those victims, many of those will be 
businesses, including large corporations,”</i> he said.<br />
<i>“At 
the moment, we are in the face of an escalating threat. The numbers are 
going up; I am worried about how the numbers will continue to grow when 
people go to work and turn [on] their machines on Monday morning,”</i> he added.<br />
<br />
<img alt="" data-aria-label-part="" height="208" src="https://pbs.twimg.com/media/C_5ELUGXoAAPTXp.jpg" style="top: 0px;" width="400" /><br />
<b>WannaCry</b> 2.0 arrives with no kill switch<br />
<a class="twitter-hashtag pretty-link js-nav" data-query-source="hashtag_click" dir="ltr" href="https://twitter.com/hashtag/WannaCry?src=hash"><s>#</s><b><b>WannaCry</b></b></a> <a class="twitter-hashtag pretty-link js-nav" data-query-source="hashtag_click" dir="ltr" href="https://twitter.com/hashtag/WannaCry2?src=hash"><s>#</s><b>WannaCry2</b></a><br />
<br />
Tech giant Microsoft recently lashed out at NSA for the role it 
played in the chain of events that led to the recent WannaCry epidemic.<br />
<i>“We
 have seen vulnerabilities stored by the CIA show up on WikiLeaks, and 
now this vulnerability stolen from the NSA has affected customers around
 the world,”</i> Microsoft President and Chief Legal Officer Brad Smith <a href="https://blogs.microsoft.com/on-the-issues/2017/05/14/need-urgent-collective-action-keep-people-safe-online-lessons-last-weeks-cyberattack/#sm.00171hptc1696eybqyy2miju9b8bn" rel="noopener noreferrer" target="_blank">said </a>in a blog post on Sunday.<br />
<i>“This attack provides yet another example of why the stockpiling of vulnerabilities by governments is such a problem.”</i><br />
<blockquote class="twitter-tweet" data-lang="en">
<div dir="ltr" lang="en">
2.7 - WannaCry Ransomware: Microsoft Calls Out NSA For 'Stockpiling' Vulnerabilities : The Two-Way : NPR <a href="https://t.co/UdFSzLuGlS">https://t.co/UdFSzLuGlS</a></div>
— Alatitude77-infosec (@AL77_infosec) <a href="https://twitter.com/AL77_infosec/status/864250327008235520">May 15, 2017</a></blockquote>
<script async="" charset="utf-8" src="//platform.twitter.com/widgets.js"></script>
<blockquote class="twitter-tweet" data-lang="en">
<div dir="ltr" lang="en">
Theft of the insidious software was reported in April. Who deployed it now is unknown. It's hit U.S., Asia, Europe.  <a href="https://t.co/dB6JcVN1wv">https://t.co/dB6JcVN1wv</a></div>
— NPR (@NPR) <a href="https://twitter.com/NPR/status/864210272239616001">May 15, 2017</a></blockquote>
<br />
<script async="" charset="utf-8" src="//platform.twitter.com/widgets.js"></script>
<br />
<iframe allowtransparency="true" frameborder="0" height="300" scrolling="no" src="https://www.facebook.com/plugins/video.php?href=https%3A%2F%2Fwww.facebook.com%2FRTvids%2Fvideos%2F1569704136373167%2F&width=660&show_text=false&height=344&appId" style="border: none; overflow: hidden;" width="500"></iframe>
<br />
</div>

WannaCry hackers have not withdrawn any ransom bitcoin, surveillance shows

Errymath

Free WannaCry decryption tools released online

WannaCry XXL? 2nd even bigger global cyber attack already underway

WannaCry hackers have not withdrawn any ransom bitcoin, surveillance shows

Latest

Archive

Subscribe