Ukraine says global cyberattack is under control as firms and government count cost

A laptop screen in Geldrop, the Netherlands displays a message after it was infected with the ransomware. Rob Engelaar / EPA

PARIS // The data-scrambling software epidemic that paralysed computers globally is under control in Ukraine, where it likely originated, officials said on Wednesday, as companies and governments around the world counted the cost of a crisis that is disrupting ports, hospitals and factories.

The Ukrainian cabinet said on Wednesday that “all strategic assets, including those involved in protecting state security, are working normally”.

The same couldn’t be said for India’s largest container port, where one of the terminals was idled by the malicious software, which goes by a variety of names including ExPetr.

MK Sirkar, a manager at the Jawaharlal Nehru Port Trust in Mumbai, said that no containers could be loaded or unloaded at the terminal operated by shipper AP Moller-Maersk on Wednesday.

Moller-Maersk acknowledged its APM Terminals had been “impacted in a number of ports” and that an undisclosed number of systems were shut down “to contain the issue”. But the company declined to provide further detail.

At the very least, thousands of computers worldwide have been struck by the malware, according to preliminary accounts published by cybersecurity firms, although most of the damage remains hidden away in corporate offices. Some names have trickled into the public domain as the disruption becomes obvious.

In Pennsylvania, lab and diagnostic services were closed at the satellite offices of Pennsylvania’s Heritage Valley Health System, for example. In Tasmania, an Australian official said a Cadbury chocolate factory had stopped production after computers there crashed.

Other organisations affected include US drugmaker Merck, food and drinks company Mondelez International, global law firm DLA Piper, and London-based advertising group WPP.

As IT security workers began trying to cleaning up the mess, others wondered at the attackers’ motives. Ransomware - which scrambles a computer’s data until a payment is made - has grown explosively over the past couple of years, powered in part by the growing popularity of digital currencies such as Bitcoin. But some believed that this latest ransomware outbreak was less aimed at gathering money than at sending a message to Ukraine and its allies.

That hunch was buttressed by the way the malware appears to have been seeded using a rogue update to a piece of Ukrainian accounting software and the timing - coming the same day as the assassination of a senior Ukrainian military intelligence officer in the nation’s capital and a day before a national holiday celebrating a new constitution signed after the breakup of the Soviet Union.

Suspicions were further heightened by the re-emergence of the mysterious Shadow Brokers group of hackers, whose dramatic leak of powerful NSA tools helped power Tuesday’s outbreak, as it did a previous ransomware explosion last month that was dubbed “WannaCry”.

In a post published on Wednesday, The Shadow Brokers made new threats, announced a new money-making scheme and made references to what happened on Tuesday.

“Another global cyber attack is fitting end for first month of theshadowbrokers dump service,” the group said, referring to a subscription service which purportedly offers hackers early access to even more of the NSA’s digital break-in tools.

“There is much theshadowbrokers can be saying about this but what is point and having not already being said?”

Few take The Shadow Brokers’ threats or their ostentatious demands for cash at face value, but the timing of their re-emergence dropped another hint at the spy games possibly playing out behind the scenes.

* Associated Press