Huge cyberattack forces Microsoft to offer free tech fix

The attack froze computers at hospitals across the country, with some cancelling all routine procedures.

Late Friday, the company posted an official notice on its site regarding the update as well as general guidance regarding the WannaCrypt attack.

Russia's Interior Ministry, with oversees the police forces, said about "1,000 computers were infected", which it described as less than 1 percent of the total, according to its website. This, security experts said, marked an unprecedented escalation in the risk of fresh attacks spreading in the coming days and weeks. Ransoms paid so far amount to only tens of thousands of dollars, one analyst said, but he predicted they would rise.

While any sized company could be vulnerable, many large organizations with robust security departments would have prioritized the update that Microsoft released in March and wouldn't be vulnerable to Friday's attack.

In April of this year an online group called The Shadow Brokers released a treasure trove of documents and tools stolen from the USA security agency NSA who used these tools to hack and spy on computers all over the world.

It's not the first time hackers have used the leaked NSA tools to infect computers. The agency has not responded to requests for comment.

Researchers with security software maker Avast said they had observed 126,534 ransomware infections in 99 countries, with Russia, Ukraine and Taiwan the top targets.

In a statement, Kaspersky Labs said it was "trying to determine whether it is possible to decrypt data locked in the attack - with the aim of developing a decryption tool as soon as possible".

More than 75,000 computers in 99 countries were compromised in Friday's attack, with a heavy concentration of infections in Russian Federation and Ukraine, according to Dutch security company Avast Software BV. And, to the relief of many holding onto old versions of Windows, the update plays nice with some old school systems, too.

"It's all hands on deck", said Shane Shook, an independent security consultant whose customers include large corporations and governments.

He said Russian Federation and India were hit particularly hard, largey because tech giant Microsoft's older Windows XP operating software was still widely used there. Accessing the same would've activated the worm-spreading functionality with the EternalBlue vulnerability, which is being exploited by Wanna Crypt ransomware.

Computer users worldwide - and everyone else who depends on them - should assume that the next big "ransomware" attack has already been launched, and just hasn't manifested itself yet, Ori Eisen, who founded the Trusona cybersecurity firm in Scottsdale, Arizona, told The Associated Press.

"We expect this number to increase significantly over the course of the weekend", said Tom Robinson, lead investigator at Elliptic.

There were no details on which companies were targeted or the origin of the attack.

The MalwareTech researcher agreed that the threat hasn't disappeared.

"The expensive part is the clean up of the machine and restoring the encrypted data", he said.

Radio Slovenia says French carmaker Renault's assembly plant in Slovenia has halted production after it was targeted in the global cyberattack.

Cluley said "There's clearly some culpability on the part of the US intelligence services". Home Secretary Amber Rudd said all but six of the NHS trusts back to normal Saturday.

German rail operator Deutsche Bahn said some electronic signs at stations announcing arrivals and departures were infected, with travellers posting pictures showing some bearing a message demanding a cash payment to restore access.

In Asia, some hospitals, schools, universities and other institutions were affected, though the full extent of the damage is not yet known because it is the weekend.

In the U.S., FedEx reported that its Windows computers were "experiencing interference" from malware, but wouldn't say if it had been hit by ransomware.

In the United States, FedEx acknowledged it had been hit by malware and was "implementing remediation steps as quickly as possible". A spokesman for Telefonica said the hack affected some employees at its headquarters, but the Spanish phone company is attacked frequently and the impact of Friday's incident wasn't major.

Over 100 nations worldwide are working to combat the WANNACRY virus.

In a statement Saturday, Europol's European Cybercrime Centre, known as EC3, said the attack "is at an unprecedented level and will require a complex global investigation to identify the culprits".

Finance chiefs from the Group of Seven rich countries will commit on Saturday to join forces to fight the growing threat of global cyber attacks, according to a draft statement of a meeting they are holding in Italy.