Subject: BREAKING NEWS: Apparent NSA tools behind massive hospital ransomware attacks around the world
From: "POLITICO" <[email-masked]>
To: <[email-masked]>
Date: Fri, 12 May 2017 12:11:50 -0600
List-Id: <1376319_6603948.xt.local>

Leaked alleged NSA hacking tools appear to be behind a massive ransomware campaign disrupting hospitals and companies across Europe.

In Spain, the country's Computer Emergency Readiness Team said that the ransomware is a modified version of the WannaCryptor toolkit. The malware was included in an online April dump from a group calling itself the Shadow Brokers, which released what they said were NSA tools. Experts have said the leaked tools appear legitimate.

Spain's CERT said the ransomware that is spreading "infects the machine by encrypting all its files" and allows the attackers to remotely control the network. The malware is also then "distributed to other Windows machines in that same network," Spain's CERT said.

The Spanish organization pointed to a Microsoft security update from March offering a fix for the flaw. 

Security researchers generally assume that the NSA secretly notified Microsoft about this and other code flaws once it discovered that they had been stolen.

Britain's National Health Service confirmed that the ransomware was a WannaCry variant called WannaCryptor.

The WannaCryptor ransomware has crippled hospitals and other companies in the United Kingdom, Spain, Russia and many other countries, and researchers say it has reached the U.S.

The cyberattack has forced at least two London hospitals to stop admitting new patients with serious medical conditions, according to a British health reporter.

Read more: http://go.politicoemail.com/?qs=ffa07c24cb9cf0165328fb542ccd566841a27fb7b37461cc073cc08f4e8769d8c379e99ac891cf2075d2f23eb93bdf8d
 To change your alert settings, please go to http://go.politicoemail.com/?qs=ffa07c24cb9cf016c8746eba8de20635fc08ab34699ecfb0eb326e25ceac6de7facbd0ceda10649a635fc321ab6290ec or http://click.politicoemail.com/profile_center.aspx?qs=c1c81b2ef644fde1dd3c1f6178ef6a8ea3ee660992025bd4489fd09f898cbb7f12dc5a413a6040b5f7137a11a699c0b83898805b6cc0df1d
This email was sent to [email-masked] by: POLITICO, LLC 1000 Wilson Blvd. Arlington, VA, 22209, USA

To unsubscribe,http://www.politico.com/_unsubscribe?e=0000015b-fdd8-d361-abff-fdda75730000&u=0000014e-f0fe-dd93-ad7f-f8fffbc40000&s=535154d0b71f0017c3d739444b9d52ed292f81d56a0208db581692bde5b717410ee178c89a87a36ad9c643b97fbd527758411f78e7d4dee0475e90fe4a31b959