Huge cyberattack ebbs as investigators work to find culprits

Posted May 15

FILE - In this May 13, 2017 file photo, a screenshot of the warning screen from a purported ransomware attack, as captured by a computer user in Taiwan, is seen on laptop in Beijing. Global cyber chaos is spreading Monday, May 14, as companies boot up computers at work following the weekend's worldwide "ransomware" cyberattack. The extortion scheme has created chaos in 150 countries and could wreak even greater havoc as more malicious variations appear. The initial attack, known as "WannaCry," paralyzed computers running Britain's hospital network, Germany's national railway and scores of other companies and government agencies around the world. (AP Photo/Mark Schiefelbein, File)

— The global cyberattack that took computer files hostage appeared to slow on Monday as authorities worked to catch the extortionists behind it — a difficult task that involves searching for digital clues and following the money.

Among their findings so far: The first suggestions of a possible link between the "ransomware" known as WannaCry and hackers linked to North Korea. Those findings remain quite tentative; one firm advancing them described them as intriguing but still "weak."

Experts had warned that WannaCry might wreak renewed havoc on Monday, particularly in Asia, which was closed for business on Friday when the malware scrambled data at hospitals, factories, government agencies, banks and other businesses.

But while there were thousands of additional infections there, the expected second-wave outbreak largely failed to materialize, in part because security researchers had already defanged it .

Mikko Hypponen, chief research officer for the Finnish security company F-Secure, said the perpetrators of WannaCry made one crucial mistake.

"The malware became too successful," Hypponen said. "When you are a cybercriminal gang and your mission is to make money, you don't want to infect 200,000 work stations. You don't want to end up on the covers of magazines. There will be no shortage of investigation."


WannaCry paralyzed computers running mostly older versions of Microsoft Windows in some 150 countries. It encrypted users' computer files and displayed a message demanding $300 to $600 worth of the digital currency bitcoin to release them; failure to pay would leave the data scrambled and likely beyond repair .

The Russian security firm Kaspersky Lab said Monday that portions of the WannaCry program use the same code as malware previously distributed by the Lazarus Group, a hacker collective behind the 2014 Sony hack blamed on North Korea.

But it's possible the code was simply copied from the Lazarus malware without any other direct connection. Kaspersky said "further research can be crucial to connecting the dots."

Another security company, Symantec, has also found similarities between WannaCry and Lazarus tools, and said it's "continuing to investigate for stronger connections."


Researchers might find some additional clues in the bitcoin accounts accepting the ransom payments. There have been three accounts identified so far, and there's no indication yet that the criminals have touched the funds. But what good is money just sitting there as digital bits?

Although bitcoin is anonymized, researchers can watch it flow from user to user. So investigators can follow the transactions until an anonymous account matches with a real person, said Steve Grobman, chief technology officer with the California security company McAfee.

But that technique is no sure bet. There are ways to convert bitcoins into cash on the sly through third parties. And even finding a real person might be no help if they're in a jurisdiction that won't cooperate.

Another possible slip-up: Nicholas Weaver, who teaches networking and security at the University of California, Berkeley, said good ransomware usually generates a unique bitcoin address for each payment to make tracing difficult. That didn't seem to happen here.


James Lewis, a cybersecurity expert at the Center for Strategic and International Studies in Washington, said U.S. investigators are collecting forensic information — such as internet addresses, samples of malware or information the culprits might have inadvertently left on computers — that could be matched with the handiwork of known hackers.

Investigators might also be able to extract some information about the attacker from a previously hidden internet address connected to WannaCry's "kill switch." That switch was essentially a beacon sending the message "hey, I'm infected" to the hidden address, Weaver said.

That means the very first attempts to reach that address, which might have been recorded by spy agencies such as the NSA or Russian intelligence, could lead to "patient zero" — the first computer infected with WannaCry. That, in turn, might further narrow the focus on possible suspects.


Forensics, though, will only get investigators so far. One challenge will be sharing intelligence in real time to move as quickly as the criminals — a tricky feat when some of the major nations involved, such as the U.S. and Russia, distrust each other.

Even if the perpetrators can be identified, bringing them to justice could be another matter. They might be hiding out in countries that wouldn't be willing to extradite suspects for prosecution, said Robert Cattanach, a former U.S. Justice Department attorney and an expert on cybersecurity.

On the other hand, the WannaCry attack hit — and annoyed — many countries. Russia was among the hardest, and Britain among the most high-profile, and both have "some pretty good investigative capabilities," Cattanach said.


Lori Hinnant in Paris and Deb Riechmann in Washington contributed to this story.


Please with your account to comment on this story. You also will need a Facebook account to comment.

Oldest First
View all
  • Henry Cooper May 15, 9:31 a.m.
    user avatar

    View quoted thread

    Current windows has the same exact behavior as an Apple when it comes to launching an executable. If you are logged in as the admin or an admin level account you will be prompted. Here is a good article to explain that.

    Using 10 year old computers as an example is like using a Edsel (old outdated car) in comparison to today's cars. Life expectancy with today's tech is 3 years by general rule. None of us carry a cell phone that is 10yo or even have a TV that old anymore.

    99% of the issues in any OS are between the keyboard and the chair.

  • Henry Cooper May 15, 9:18 a.m.
    user avatar

    View quoted thread

    This is the issue. Apple hacks don't get the pub so people think they are "safe" and it is just not the case. Many times it works against the Mac user because they think they are impenetrable so they do not exercise the caution they should.

    Less than a week ago someone hacked The Apple Store and replaced the very popular video editing software HandBrake. That is not a person failing to patch an OS or using an out of date one as this was. This was Apple's Store where every Apple user HAS TO get the current software from. To add to this at the time NONE of the virus scans would catch it.

    Don't be fooled because the story does not make the headline.

  • Megan Goodson May 15, 8:28 a.m.
    user avatar

    And THIS is why I will cough up $2000 for an apple computer. They may confused you, they maybe "hard" to use and not "user friendly" (though I've never had a problem with them) ..but they are SAFER than Windows. Windows System will open any .exe that is downloaded to its system without asking. Apple never opens anything unless you specifically tells it too and then won't even install it without a master password. So virus' can just lay dorment for years hidden because they can't be used. My friend's computer was 10 years old when I had to help her with a small problem. I ran malware and a virus check just in case - we found 88 DORMANT virus's and just deleted them. Her problem wound up being with a messed up registry file but still virus caused it.