Hospitals, companies, universities and governments across at least 150 countries were hounded by a cyberattack that locked computers and demanded ransom. 
 
 It's one of the largest attacks ever carried out. The attack hit more than 200,000 victims, according to Europol. That number has grown since Friday, when attacks were first reported. 
 
 Experts have said they expect that number to pop on Monday when people return to work and fire up their computers. And Europol said Sunday that a new strain of the ransomware had been discovered. 
 
 "We will get a decryption tool eventually, but for the moment, it's still a live threat and we're still in disaster recovery mode," Europol director Rob Wainwright said on CNN. 
 
 Exactly which computers were are being targeted remains fuzzy -- but here's who we know has been impacted so far. 
 
 Global Companies 
 
 FedEx: The company said it was "experiencing interference with some of our Windows-based systems caused by malware" and was trying to fix the problems as quickly as possible. 
 
 Nissan: The carmaker said in a statement that "some Nissan entities were recently targeted" but "there has been no major impact on our business." 
 
 China 
 
 Colleges: Internet security firm Qihoo360 issued a "red alert" over the weekend, saying a large number of colleges and students in China had been hit by the ransomware attack. 
 
 Gas stations: State-run media in China reported that some gas stations saw their digital payment systems shut down, forcing customers to bring cash. 
 
 Germany 
 
 Deutsche Bahn: The German railway company told CNNMoney that due to the attack "passenger information displays in some stations were inoperative" as were "some ticket machines." 
 
 Russia 
 
 Russian Central Bank: State media agency Tass reported the bank discovered malware bulk emails to banks but detected no compromise of resources. The central bank reportedly said those monitoring the cyberattacks found "no incidents compromising data resources of banking institutions." 
 
 Russian Railways: State media said a virus attacked the IT system of Russian Railways, but it did not affect operations due to a prompt response. The company said the virus has been localized and "technical work is underway to destroy it and update the antivirus protection." 
 
 Interior Ministry: The Russian Interior Ministry acknowledged a ransomware attack on its computers, adding that less than 1% of computers were affected. The statement said antivirus systems are working to destroy it. 
 
 Megafon: A spokesperson for Russian telecommunications company Megafon told CNN that the cyberattack affected call centers but not the company's networks. He said the situation was under control. 
 
 Spain 
 
 Telefónica: Spanish authorities confirmed the Spanish telecom company Telefónica (TEF) was one of the targets, though the attack affected only some computers and did not compromise the security of clients' information. 
 
 United Kingdom 
 
 National Health Service: At least sixteen NHS organizations have been hit, according to NHS Digital. "At this stage, we do not have any evidence that patient data has been accessed. We will continue to work with affected (organizations) to confirm this," the agency said. The NHS has said hospitals have had to cancel some outpatient appointments because of the attack. 
 
 Appeal from acute nurse director due to ransomware attack. pic.twitter.com/xwPoNbGTTy — NHS Lanarkshire (@NHSLanarkshire) May 12, 2017 
 
 The UK government called a meeting of its crisis response committee, known as Cobra, to discuss how to handle the situation. The British Home Secretary said most of the NHS systems were back to normal by midday Saturday. ||||| Expert who stopped spread of attack by activating software’s ‘kill switch’ says criminals will ‘change the code and start again’ 
 
 The “accidental hero” who halted the global spread of an unprecedented ransomware attack by registering a garbled domain name hidden in the malware has warned the attack could be rebooted. 
 
 The ransomware used in Friday’s attack wreaked havoc on organisations including FedEx and Telefónica, as well as the UK’s National Health Service (NHS), where operations were cancelled, X-rays, test results and patient records became unavailable and phones did not work. 
 
 But the spread of the attack was brought to a sudden halt when one UK cybersecurity researcher tweeting as @malwaretechblog, with the help of Darien Huss from security firm Proofpoint, found and inadvertently activated a “kill switch” in the malicious software. 
 
 Cyber-attack hits 74 countries with UK hospitals among targets – live updates Read more 
 
 The researcher, who identified himself only as MalwareTech, is a 22-year-old from south-west England who works for Kryptos logic, an LA-based threat intelligence company. 
 
 “I was out having lunch with a friend and got back about 3pm and saw an influx of news articles about the NHS and various UK organisations being hit,” he told the Guardian. “I had a bit of a look into that and then I found a sample of the malware behind it, and saw that it was connecting out to a specific domain, which was not registered. So I picked it up not knowing what it did at the time.” 
 
 The kill switch was hardcoded into the malware in case the creator wanted to stop it spreading. This involved a very long nonsensical domain name that the malware makes a request to – just as if it was looking up any website – and if the request comes back and shows that the domain is live, the kill switch takes effect and the malware stops spreading. The domain cost $10.69 and was immediately registering thousands of connections every second. 
 
 MalwareTech explained that he bought the domain because his company tracks botnets, and by registering these domains they can get an insight into how the botnet is spreading. “The intent was to just monitor the spread and see if we could do anything about it later on. But we actually stopped the spread just by registering the domain,” he said. But the following hours were an “emotional rollercoaster”. 
 
 “Initially someone had reported the wrong way round that we had caused the infection by registering the domain, so I had a mini freakout until I realised it was actually the other way around and we had stopped it,” he said. 
 
 MalwareTech said he preferred to stay anonymous “because it just doesn’t make sense to give out my personal information, obviously we’re working against bad guys and they’re not going to be happy about this.” 
 
 He also said he planned to hold onto the URL, and he and colleagues were collecting the IPs and sending them off to law enforcement agencies so they can notify the infected victims, not all of whom are aware that they have been affected. 
 
 He warned people to patch their systems, adding: “This is not over. The attackers will realise how we stopped it, they’ll change the code and then they’ll start again. Enable windows update, update and then reboot.” 
 
 He said he got his first job out of school without any real qualifications, having skipped university to start up a tech blog and write software. 
 
 “It’s always been a hobby to me, I’m self-taught. I ended up getting a job out of my first botnet tracker, which the company I now work for saw and contacted me about, asking if I wanted a job. I’ve been working there a year and two months now.” 
 
 But the dark knight of the dark web still lives at home with his parents, which he joked was “so stereotypical”. His mum, he said, was aware of what had happened and was excited, but his dad hadn’t been home yet. “I’m sure my mother will inform him,” he said. 
 
 “It’s not going to be a lifestyle change, it’s just a five-minutes of fame sort of thing. It is quite crazy, I’ve not been able to check into my Twitter feed all day because it’s just been going too fast to read. Every time I refresh it it’s another 99 notifications.” 
 
 
 
 Proofpoint’s Ryan Kalember said the British researcher gets “the accidental hero award of the day”. “They didn’t realise how much it probably slowed down the spread of this ransomware”. 
 
 The time that @malwaretechblog registered the domain was too late to help Europe and Asia, where many organisations were affected. But it gave people in the US more time to develop immunity to the attack by patching their systems before they were infected, said Kalember. 
 
 Play Video 0:32 Theresa May: 'This is not targeted at the NHS, it’s an international attack' – video 
 
 The kill switch won’t help anyone whose computer is already infected with the ransomware, and it’s possible that there are other variants of the malware with different kill switches that will continue to spread. 
 
 The malware was made available online on 14 April through a dump by a group called Shadow Brokers, which claimed last year to have stolen a cache of “cyber weapons” from the National Security Agency (NSA). 
 
 Ransomware is a type of malware that encrypts a user’s data, then demands payment in exchange for unlocking the data. This attack used a piece of malicious software called “WanaCrypt0r 2.0” or WannaCry, that exploits a vulnerability in Windows. Microsoft released a patch (a software update that fixes the problem) for the flaw in March, but computers that have not installed the security update remain vulnerable. 
 
 MalwareTech (@MalwareTechBlog) I will confess that I was unaware registering the domain would stop the malware until after i registered it, so initially it was accidental. 
 
 The ransomware demands users pay $300 worth of cryptocurrency Bitcoin to retrieve their files, though it warns that the “payment will be raised” after a certain amount of time. Translations of the ransom message in 28 languages are included. The malware spreads through email. 
 
 “This was eminently predictable in lots of ways,” said Kalember. “As soon as the Shadow Brokers dump came out everyone [in the security industry] realised that a lot of people wouldn’t be able to install a patch, especially if they used an operating system like Windows XP [which many NHS computers still use], for which there is no patch.” 
 
 Security researchers with Kaspersky Lab have recorded more than 45,000 attacks in 74 countries, including the UK, Russia, Ukraine, India, China, Italy, and Egypt. In Spain, major companies including telecommunications firm Telefónica were infected. 
 
 By Friday evening, the ransomware had spread to the United States and South America, though Europe and Russia remained the hardest hit, according to security researchers Malware Hunter Team. The Russian interior ministry says about 1,000 computers have been affected. ||||| So finally I’ve found enough time between emails and Skype calls to write up on the crazy events which occurred over Friday, which was supposed to be part of my week off (I made it a total of 4 days without working, so there’s that). You’ve probably read about the WannaCrypt fiasco on several news sites, but I figured I’d tell my story. 
 
 I woke up at around 10 AM and checked onto the UK cyber threat sharing platform where i had been following the spread of the Emotet banking malware, something which seemed incredibly significant until today. There were a few of your usual posts about various organisations being hit with ransomware, but nothing significant…yet. I ended up going out to lunch with a friend, meanwhile the WannaCrypt ransomware campaign had entered full swing. 
 
 When I returned home at about 2:30, the threat sharing platform was flooded with posts about various NHS systems all across the country being hit, which was what tipped me of to the fact this was something big. Although ransomware on a public sector system isn’t even newsworthy, systems being hit simultaneously across the country is (contrary to popular belief, most NHS employees don’t open phishing emails which suggested that something to be this widespread it would have to be propagated using another method). I was quickly able to get a sample of the malware with the help of Kafeine, a good friend and fellow researcher. Upon running the sample in my analysis environment I instantly noticed it queried an unregistered domain, which i promptly registered. 
 
 Using Cisco Umbrella, we can actually see query volume to the domain prior to my registration of it which shows the campaign started at around 8 AM UTC. 
 
 While the domain was propagating, I ran the sample again in my virtual environment to be met with WannaCrypt ransom page; but more interestingly was that after encrypting the fake files I left there as a test, it started connecting out to random IP addresses on port 445 (used by SMB). The mass connection attempts immediately made me think exploit scanner, and the fact it was scanning on the SMB port caused me to look back to the recent ShadowBroker leak of NSA exploits containing….an SMB exploit. Obvious I had no evidence yet that it was definitely scanning SMB hosts or using the leaked NSA exploit, so I tweeted out my finding and went to tend to the now propagated domain. 
 
 Sample I found scans SMB after dropping WannaCrypt. Can anyone confirm it's the same thing? P2P spreading ransomware would be significant. pic.twitter.com/zs5Td4ovvL — MalwareTech (@MalwareTechBlog) May 12, 2017 
 
 Now one thing that’s important to note is the actual registration of the domain was not on a whim. My job is to look for ways we can track and potentially stop botnets (and other kinds of malware), so I’m always on the lookout to pick up unregistered malware control server (C2) domains. In fact I registered several thousand of such domains in the past year. 
 
 Our standard model goes something like this. 
 
 Look for unregistered or expired C2 domains belonging to active botnets and point it to our sinkhole (a sinkhole is a server designed to capture malicious traffic and prevent control of infected computers by the criminals who infected them). Gather data on the geographical distribution and scale of the infections, including IP addresses, which can be used to notify victims that they’re infected and assist law enforcement. Reverse engineer the malware and see if there are any vulnerabilities in the code which would allow us to take-over the malware/botnet and prevent the spread or malicious use, via the domain we registered. 
 
 In the case of WannaCrypt, step 1, 2 and 3 were all one and the same, I just didn’t know it yet. 
 
 A few seconds after the domain had gone live I received a DM from a Talos analyst asking for the sample I had which was scanning SMB host, which i provided. Humorously at this point we had unknowingly killed the malware so there was much confusion as to why he could not run the exact same sample I just ran and get any results at all. As curious as this was, I was pressed for time and wasn’t able to investigate, because now the sinkhole servers were coming dangerously close to their maximum load. 
 
 I set about making sure our sinkhole server were stable and getting the expected data from the domain we had registered (at this point we still didn’t know much about what the domain I registered was for, just that anyone infected with this malware would connect to the domain we now own, allowing us to track the spread of the infection). Sorting out the sinkholes took longer than expected due to a very large botnet we had sinkholed the previous week eating up all the bandwidth, but soon enough I was able to set up a live tracking map and push it out via twitter (you can still see it here). 
 
 Around 6:23 PM (BST) I asked an employee to look into the worm code and verify the domain we registered would not change (some malware will periodically change the domain using an algorithm, so we needed to know if there would be new domains so we could register those too), meanwhile I performed some updated to the live map to deal with the rapid influx of new visitors. 
 
 After about 5 minutes the employee came back with the news that the registration of the domain had triggered the ransomware meaning we’d encrypted everyone’s files (don’t worry, this was later proven to not be the case), but it still caused quite a bit of panic. I contacted Kafeine about this and he linked me to the following freshly posted tweet made by ProofPoint researcher Darien Huss, who stated the opposite (that our registration of the domain had actually stopped the ransomware and prevent the spread). 
 
 #WannaCry propagation payload contains previously unregistered domain, execution fails now that domain has been sinkholed pic.twitter.com/z2ClEnZAD2 — Darien Huss (@darienhuss) May 12, 2017 
 
 Having heard to conflicting answers, I anxiously loaded back up my analysis environment and ran the sample….nothing. I then modified my host file so that the domain connection would be unsuccessful and ran it again…..RANSOMWARED. 
 
 Now you probably can’t picture a grown man jumping around with the excitement of having just been ransomwared, but this was me. The failure of the ransomware to run the first time and then the subsequent success on the second mean that we had in fact prevented the spread of the ransomware and prevented it ransoming any new computer since the registration of the domain (I initially kept quiet about this while i reverse engineered the code myself to triple check this was the case, but by now Darien’s tweet had gotten a lot of traction). 
 
 So why did our sinkhole cause an international ransomware epidemic to stop? 
 
 Talos wrote a great writeup explaining the code side here, which I’ll elaborate on using Darien’s screenshot. 
 
 All this code is doing is attempting to connect to the domain we registered and if the connection is not successful it ransoms the system, if it is successful the malware exits (this was not clear to me at first from the screenshot as I lacked the context of what the parent function may be doing with the results). 
 
 The reason which was suggested is that the domain is a “kill switch” in case something goes wrong, but I now believe it to be a badly thought out anti-analysis. 
 
 In certain sandbox environments traffic is intercepted by replying to all URL lookups with an IP address belonging to the sandbox rather than the real IP address the URL points to, a side effect of this is if an unregistered domain is queried it will respond as it it were registered (which should never happen). 
 
 I believe they were trying to query an intentionally unregistered domain which would appear registered in certain sandbox environments, then once they see the domain responding, they know they’re in a sandbox the malware exits to prevent further analysis. This technique isn’t unprecedented and is actually used by the Necurs trojan (they will query 5 totally random domains and if they all return the same IP, it will exit); however, because WannaCrypt used a single hardcoded domain, my registartion of it caused all infections globally to believe they were inside a sandbox and exit…thus we initially unintentionally prevented the spread and and further ransoming of computers infected with this malware. Of course now that we are aware of this, we will continue to host the domain to prevent any further infections from this sample. 
 
 One thing that is very important to note is our sinkholing only stops this sample and there is nothing stopping them removing the domain check and trying again, so it’s incredibly importiant that any unpatched systems are patched as quickly as possible. 
 
 As well as the names & companies mentioned in this blog I’d like to give a shout out to: 
 
 NCSC UK – Their threat intelligence sharing program provided us with valuable information needed to first identify the malware family behind the attack. They also helped ensure our sinkholes were not mistaken for criminal controlled infrastructure so that we could feed them the information required to notify UK victims. 
 
 FBI & ShadowServer – They were a great help in getting non-UK victims notified of the infections in a very short span of time, even if it did mean me staying up all night to link in with them. 
 
 2sec4u – For reducing my workload today and providing free panic attacks. 
 
 Microsoft – By realeasing an out of bounds patch for unsupported operating systems such as Windows XP and Server 2003, people now are able to patch rather than having to attempt upgrades to newer system in order to be secured against this worm. 
 
 If you have anything to patch, patch it. If you need a guide, this one is being reguarly updated: https://www.ncsc.gov.uk/guidance/protecting-your-organisation-ransomware 
 
 Now I should probably sleep.
– The "accidental hero" who inadvertently stopped Friday's massive cyberattack that affected nearly 100 countries is a 22-year-old who lives with his parents, the Guardian reports. The British cybersecurity researcher—who's keeping anonymous to protect himself—found a nonsensical website address in the code for the ransomware holding victims' data hostage and causing chaos around the globe. He spent less than $11 to register the domain with the hope of monitoring the spread of the ransomware. But it turns out, registering the domain was a "kill switch" added by the creators of the ransomware in case they ever wanted to stop it themselves. For a more in-depth explanation, check out the 22-year-old's blog titled "How to Accidentally Stop a Global Cyber Attack." But while the spread of the ransomware has been halted for now, the world's computer systems are far from in the clear. Cybersecurity expert Matt Suiche says whoever is behind the attack—their identity is still unknown—can simply update the ransomware and start again. "I'd even say this update probably already happened," he tells ABC News. There were 75,000 individual attacks across 99 countries Friday. CNN runs down the victims, which include FedEx, Nissan, the Russian Central Bank, Britain's National Health Service, and Spain's Telefonica. Most of the attacks were in Russia, Ukraine, and Taiwan.