Another Massive Ransomware Outbreak Is Going Global Fast

Ukraine’s government, National Bank and biggest power companies all warned of cyberattacks Tuesday. Airports and metro services in the country were also reportedly affected, though it appears they’re victims of another massive ransomware outbreak that’s spreading across the world fast and hitting a significant number of critical infrastructure providers.

Whispers of WannaCry abound, though security experts said a different breed, named Petya, was to blame. “[We're seeing] several thousands of infection attempts at the moment, comparable in size to WannaCry’s first hours,” said Kaspersky Lab’s Costin Raiu. “We are seeing infections from many different countries.” One firm, BitDefender, said it believed a similar strain called GoldenEye was actually responsible. Later, security firms, including Kaspersky and Avast, said the malware responsible was actually an entirely new ransomware that had borrowed Petya code.

Thomas Fox-Brewster , FORBES STAFF
I cover crime, privacy and security in digital and physical forms.

Play Video

Ransomware is causing severe problems for major critical infrastructure providers today. (Photo credit: DAMIEN MEYER/AFP/Getty Images)

Ukraine’s government, National Bank and biggest power companies all warned of cyberattacks Tuesday. Airports and metro services in the country were also reportedly affected, though it appears they’re victims of another massive ransomware outbreak that’s spreading across the world fast and hitting a significant number of critical infrastructure providers.

Whispers of WannaCry abound, though security experts said a different breed, named Petya, was to blame. “[We're seeing] several thousands of infection attempts at the moment, comparable in size to WannaCry’s first hours,” said Kaspersky Lab’s Costin Raiu. “We are seeing infections from many different countries.” One firm, BitDefender, said it believed a similar strain called GoldenEye was actually responsible. Later, security firms, including Kaspersky and Avast, said the malware responsible was actually an entirely new ransomware that had borrowed Petya code.

Regardless of what malware was used, the attacks have gone global. This morning saw major Danish shipping and energy company Maersk report a cyber attack, noting on its website: “We can confirm that Maersk IT systems are down across multiple sites and business units due to a cyber attack.” And Russian oil industry giant Rosnoft said it was facing a “powerful hacker attack.” Major British advertiser WPP said on Facebook it was also hit by an attack, while law firm DLA Piper also confirmed it had been targeted by hackers. None offered specifics on the nature of those hacks.

Sources told Forbes of one U.S. target: pharmaceuticals company Merck. One source said the problem extended to global offices, including those in Ireland, with both phones and PCs out of action, and employees going home. Merck Sharp & Dohme (MSD), the U.K. subsidiary of Merck, confirmed its network was compromised. “We’re trying to understand the level of impact,” a spokesperson said. “We’re trying to operate as normally as possible.”

Ukraine the main target

The impact initially appeared to be most severe in Ukraine, with very few in the U.S., according to Kaspersky. The organization managing the zone of the Chernobyl disaster fallout said it had to switch radiation monitoring services on industrial sites to manual as they had to shut all Windows computers down, though automated systems for the rest of the zone operated normally. The main Chernobyl plant website has also been closed.