French car maker Renault SA, which halted production at some factories to stop the virus from spreading, said 90% of factories worldwide had now resumed operations, according to a spokesman Monday.

A new version of the ransomware may have also been spreading over the weekend. Matt Suiche, founder of United Arab Emirates-based cyber security firm Comae Technologies, said around 10,000 machines have been infected by the second variation of the malware.

The malware used a technique purportedly stolen from the U.S. National Security Agency. It affected the U.K.'s National Health Service, Russia's Ministry of Interior, China government agencies, Deutsche Bahn, automakers Nissan Motor Co. and Renault, PetroChina, logistics giant FedEx Corp., and other company and hospital computer systems in countries from Eastern Europe to the U.S. and Asia.

The hackers used the tool to encrypt files within affected computers, making them inaccessible, and demanded ransom — typically $300 in bitcoin. Russia and Ukraine had a heavy concentration of infections, according to Dutch security company Avast Software BV.

Microsoft Corp. President Brad Smith, in a blog post Sunday, said the attack is a “wake-up call” for governments in the U.S. and elsewhere to stop stockpiling tools to exploit digital vulnerabilities. “They need to take a different approach and adhere in cyberspace to the same rules applied to weapons in the physical world,” he said.

Normal Operations

About 97% of U.K. facilities and doctors disabled by the attack were back to normal operation, Home Secretary Amber Rudd said Saturday after a government meeting. At the height of the attack Friday and early Saturday, 48 organizations in the NHS were affected, and hospitals in London, North West England and Central England urged people with non-emergency conditions to stay away as technicians tried to stop the spread of the malicious software.

The initial attack was stifled when a security researcher disabled a key mechanism used by the worm to spread, but experts said the hackers were likely to mount a second attack because so many users of personal computers with Microsoft operating systems couldn't or didn't download a security patch released in March that Microsoft had labeled “critical.”

Microsoft said in a blog post Saturday that it was taking the “highly unusual“ step of providing the patch for older versions of Windows it was otherwise no longer supporting, including Windows XP and Windows Server 2003.

While the scale of the attack shows Microsoft needs to strengthen its own capabilities, “there is simply no way for customers to protect themselves against threats unless they update their system,” Smith said in his blog post. “Otherwise they're literally fighting the problems of the present with tools from the past.

“This attack is a powerful reminder that information technology basics like keeping computers current and patched are a high responsibility for everyone, and it's something every top executive should support.”

Victims have paid about $50,000 in ransom so far, with the total expected to rise, said Tom Robinson, chief operating officer and co-founder of Elliptic Enterprises Ltd., a ransomware consultant that works with banks and companies in the U.K., U.S. and Europe. Robinson, in an interview by email, said he calculated the total based on payments tracked to bitcoin addresses specified in the ransom demands.

Last year an acute-care hospital in Hollywood paid $17,000 in bitcoin to an extortionist who hijacked its computer systems and forced doctors and staff to revert to pen and paper for record-keeping.

Business Targets

A spokesman for Spain's Telefonica SA said the hack affected some employees at its headquarters, but the phone company is attacked frequently and the impact of Friday's incident wasn't major. FedEx said it was “experiencing interference,” the Associated Press reported.

Renault halted production at some factories to stop the virus from spreading, a spokesman said Saturday, while Nissan's car plant in Sunderland, in northeast England, was affected without causing any major impact on business, an official said.

Russia's Interior Ministry, with oversight of the police forces, said about “1,000 computers were infected,” which it described as less than 1 percent of the total, according to its website.

In China, the malware affected computers at “several” unspecified government departments, the country's Cyberspace Administration said on its WeChat blog Monday. Since that initial attack, agencies and companies from the police to banks and communications firms have put preventive measures in place, while Qihoo 360 Technology Co., Tencent Holdings Ltd. and other cybersecurity firms have begun making protection tools available, the internet overseer said.

China National Petroleum Corp., which owns PetroChina, reported that some of its 21,000 gas stations had seen their digital payment systems disabled by the attack and resorted to accepting cash. More than 80% of the stations had been reconnected to the network as of noon on May 14, the company said. Several Chinese universities had also been hit by the attacks, according to local media reports.

In Japan, Hitachi Ltd. said that some of its computers had been affected. In South Korea, CJ CGV Co., the country's largest cinema chain, said advertising servers and displays at film theaters were hit by ransomware. Movie servers weren't affected and are running as normal, it said in a text message Monday. Indonesia's government reported two hospitals in Jakarta were affected.

While any size company could be vulnerable, many large organizations with robust security departments would have prioritized the update that Microsoft released in March and wouldn't be vulnerable to Friday's attack.

Users Tricked

Ransomware is a particularly stubborn problem because victims are often tricked into allowing the malicious software to run on their computers, and the encryption happens too fast for security software to catch it. Some security experts calculate that ransomware may bring in as much as $1 billion a year in revenue for the attackers.

The attack was apparently halted in the afternoon in the U.K. when a researcher took control of an Internet domain that acted as a kill switch for the worm's propagation, according to Ars Technica.

“I will confess that I was unaware registering the domain would stop the malware until after I registered it, so initially it was accidental,” wrote the researcher, who uses the Twitter name @MalwareTechBlog. “So long as the domain isn't revoked, this particular strain will no longer cause harm, but patch your systems ASAP as they will try again.”

A second variant of the domain also became apparent. Suiche, founder of Comae Technologies, said on Sunday he registered another kill-switch for a different version of the ransomware. About 50% of machines that would have spread the infection by the second variation of the malware have Russian I.P. addresses, according to Suiche.

There is a high probability that Russian-language cybercriminals were behind the attack, said Aleks Gostev, chief cybersecurity expert for Kaspersky Labs.

“Ransomware is traditionally their topic,” he said. “The geography of attacks that hit post-Soviet Union most also suggests that.”

Bloomberg News

Copyright 2018 Bloomberg. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.