'SA affected in global cyberattack'

Cyber security company Gold 'N Links Cyber says the malware used in the attack blocks computers until money is paid to unlock it.

Picture: freeimages.com

JOHANNESBURG - South Africa is among the countries believed to be affected by the biggest global cyberattack.

It's understood the attack took place on Friday afternoon.

Cyber security company Gold 'N Links Cyber says the malware used in the attack blocks computers until money is paid to unlock it.

In the United Kingdom, sixteen hospitals had to shut down as staff were not able to access the files of patients.

GnL Cyber's Roi Shoposhnik explains: “A group of hackers identified a security patch that was issued by Microsoft in March this year. They have managed to access more than 100,000 computers around the world.”

Cyber extortionists tricked victims into opening malicious malware attachments to spam emails that appeared to contain invoices, job offers, security warnings and other legitimate files.

The ransomware encrypted data on the computers, demanding payments of $300 to $600 to restore access. Security researchers said they observed some victims paying via the digital currency bitcoin, though they did not know what percent had given in to the extortionists.

Researchers with security software maker Avast said they had observed 57,000 infections in 99 countries with Russia, Ukraine and Taiwan the top targets.

The most disruptive attacks were reported in Britain, where hospitals and clinics were forced to turn away patients after losing access to computers.

International shipper FedEx Corp said some of its Windows computers were also infected. "We are implementing remediation steps as quickly as possible," it said in a statement.

Still, only a small number of US-headquartered organisations were hit because the hackers appear to have begun the campaign by targeting organisations in Europe, said Vikram Thakur, research manager with security software maker Symantec.

By the time they turned their attention to the United States, spam filters had identified the new threat and flagged the ransomware-laden emails as malicious, Thakur said.

The US Department of Homeland Security said late on Friday that it was aware of reports of the ransomware, was sharing information with domestic and foreign partners and was ready to lend technical support.

Telecommunications company Telefonica was among many targets in Spain, though it said the attack was limited to some computers on an internal network and had not affected clients or services. Portugal Telecom and Telefonica Argentina both said they were also targeted.

Private security firms identified the ransomware as a new variant of "WannaCry" that had the ability to automatically spread across large networks by exploiting a known bug in Microsoft's Windows operating system.

Additional reporting by Reuters.

(Edited by Shimoney Regter)