Cyberattack may be more than mere moneymaker, evidence suggests

In the aftermath of a malicious software attack that affected companies worldwide on Tuesday, analysis of the culpable code as well as recent events have led experts to believe that the attack may have been more malicious than a mere ransomware theft.

Vadim Ghirda/AP
A woman sits backdropped by a real time cyberattacks world map, at the headquarters of Bitdefender in Bucharest, Romania, on June 28, 2017. Emerging evidence suggests that a worldwide cyberattack June 27 may have had a more malicious purpose than moneymaking.

The dramatic data-scrambling attack that hit computers around the world Tuesday appears to be contained. But with the damage and disruption still coming into focus, security experts worry the sudden explosion of malicious software may have been more sinister than a criminally minded shakedown of computer users.

"There may be a more nefarious motive behind the attack," Gavin O'Gorman, an investigator with United States antivirus firm Symantec, said in a blog post. "Perhaps this attack was never intended to make money [but] rather to simply disrupt a large number of Ukrainian organizations."

The rogue program initially appeared to be ransomware, a fast-growing and lucrative breed of malicious software that encrypts its victims' data and holds it hostage until a payment is made.

But Mr. O'Gorman was one of several researchers who noted that any criminals would have had difficulty monetizing the epidemic given that they appear to have relied on a single email address that was blocked almost immediately and a single Bitcoin wallet that, to date, has collected the relatively puny sum of $10,000.

Others, such as Russian anti-virus firm Kaspersky Lab, said that clues in the code suggest the program's authors would have been incapable of decrypting the data in any case, adding further evidence that the ransom demands were a smoke screen.

The timing was intriguing, too: The malware explosion came the same day as the assassination of a senior Ukrainian military intelligence officer and a day before a national holiday celebrating a new constitution signed after the breakup of the Soviet Union.

Ransomware or not, computer specialists worldwide were still wrestling with its consequences, with varying degrees of success.

Danish shipping giant A.P. Moller-Maersk, one of the global companies hardest hit by the malware, said Thursday that most of its terminals are now operational, though some terminals are "operating slower than usual or with limited functionality."

Problems have been reported across the shippers' global business, from Mobile, Ala.; to Mumbai, India. When The Associated Press visited the latter city's Jawaharlal Nehru Port Trust on Thursday, for example, it witnessed several hundred containers piled up at just two yards, out of more than a dozen yards surrounding the port.

"The vessels are coming, the ships are coming, but they are not able to take the container because all the systems are down," trading and clearing agent Rajeshree Verma told the AP. "The port authorities, they are not able to reply [to] us. The shipping companies they also don't know what to do.... We are actually in a fix because of all this."

Moller-Maersk is one of dozens of major corporations and government agencies – from FedEx subsidiary TNT to Ukraine's banking system – to have had its services disrupted by the malware epidemic.

Even small businesses otherwise unaffected by the malware are beginning to feel the pain.

Steffan Mastek of Petersen & Soerensen, a small Danish ship repair company, said he had been forced to re-order engine parts because TNT's track-and-trace system for parcels was down.

"We had to re-order the parts that need to be fitted to a ship engine and that has to be done by Friday when the ship has to be returned," Mr. Mastek said.

The extent and costs of the damage in Ukraine remains unclear, although on the streets of Kiev, the capital, life appears largely back to normal. Cash machines that had spent the past two days offline were back dispensing money and the capital's airport, which had to switch information panels to manual mode for the past two days, is back to displaying flights automatically.

You've read  of  free articles. Subscribe to continue.

Dear Reader,

About a year ago, I happened upon this statement about the Monitor in the Harvard Business Review – under the charming heading of “do things that don’t interest you”:

“Many things that end up” being meaningful, writes social scientist Joseph Grenny, “have come from conference workshops, articles, or online videos that began as a chore and ended with an insight. My work in Kenya, for example, was heavily influenced by a Christian Science Monitor article I had forced myself to read 10 years earlier. Sometimes, we call things ‘boring’ simply because they lie outside the box we are currently in.”

If you were to come up with a punchline to a joke about the Monitor, that would probably be it. We’re seen as being global, fair, insightful, and perhaps a bit too earnest. We’re the bran muffin of journalism.

But you know what? We change lives. And I’m going to argue that we change lives precisely because we force open that too-small box that most human beings think they live in.

The Monitor is a peculiar little publication that’s hard for the world to figure out. We’re run by a church, but we’re not only for church members and we’re not about converting people. We’re known as being fair even as the world becomes as polarized as at any time since the newspaper’s founding in 1908.

We have a mission beyond circulation, we want to bridge divides. We’re about kicking down the door of thought everywhere and saying, “You are bigger and more capable than you realize. And we can prove it.”

If you’re looking for bran muffin journalism, you can subscribe to the Monitor for $15. You’ll get the Monitor Weekly magazine, the Monitor Daily email, and unlimited access to CSMonitor.com.