The UK's National Health Service (NHS) has been hit by a massive ransomware attack that appears to be part of a global campaign. So far, the attack has affected hospitals and businesses across the UK and beyond.
The attack began yesterday, Friday, and according to observers, we have never seen anything like it before, as it appears to have affected at least 74 countries.
The attack's masterminds are promoting the WannaCry ransomware, which locks computer files.
It should be noted that this ransomware is based on one of the NSA exploits recently leaked by the Shadow Brokers.
Attackers are using a Windows exploit that was adopted from the NSA's EternalBlue tool to infect computers with WannaCry . Microsoft has already released a patch for this vulnerability, but many users and organizations have not bothered to update their systems.
The malware infects a computer by exploiting a vulnerability in SMB file sharing. Older versions of Windows are most affected by this, especially since Microsoft no longer supports Windows XP or Windows (server) 2003.
“Today’s ransomware attack that hit the NHS, Telefonica and others in over 70 countries is unprecedented in what we have seen so far from ransomware attacks. Based on what we have seen today, it appears that this attack is perfect and uses unspecified vulnerabilities in combination with Ransomware encryption,” said Travis Farral, Director of Security Strategy at Anomali and former ExxonMobil security supervisor.
Security researchers from Malwarebytes believe that this malware is very dangerous because it locks files with RSA-2048 encryption, which means that they are almost impossible to decrypt without the attacker's key.
The scammers are demanding $300 from their victims, a small amount considering that the malicious campaign targets utilities and healthcare companies.
“We hope that the affected companies will be able to quickly find their backups,” Malwarebytes researchers say.
