last year by a campaign of “ spear-phishingAttack.Phishing” . The hackers ’ method , in which messages appear to come fromAttack.Phishinga trusted source but are infected with malware , were relatively sophisticated . Sources said that the people behind the attack , Callisto Group , were probably linked to Russia although that could not be proved . The BBC reported that the Foreign Office was among the targets and the attack began in April last year . It is understood that it was not considered a high-level attack and that sensitive information was not kept on the systems that were targeted .
Google users today were hitAttack.Phishingwith an extremely convincing phishing spreeAttack.Phishinglaunched by attackers who manipulated Google Docs ' legitimate third-party sharing mechanism . Targets receivedAttack.Phishingmessages with the subject like `` [ Sender ] has shared a document on Google Docs with you '' often from senders they knew . The messages contained links , which led to a page that clearly requested access to the user 's Gmail account . If the target user provides access , the attackAttack.Phishingbegins sendingAttack.Phishingspam to all the user 's contacts . Theoretically , the attacker could also accessAttack.Databreachthe victim 's messages and stealAttack.Databreachsensitive data , but thus far there have been no reports of such activity . Because it takes advantage of Google 's legitimate third-party sharing mechanism , the phishing message is much more difficult to identify as malicious . The icons and messaging are familiar to Google users . Gmail itself did not filter the messages as phishingAttack.Phishingor flag them as spam , but rather sent them to Gmail users ' `` Primary '' inbox mail folders . The senders were familiar enough to have the target in their contact lists . One way to spot the attack : some targets report that the message includes a recipient with an address that begins `` hhhhhhhhhhhhhh '' and ends with the domain `` mailinator.com . '' Google responded with a fix and issued a statement : `` We have taken action to protect users against an email impersonatingAttack.PhishingGoogle Docs , and have disabled offending accounts . We ’ ve removed the fake pages , pushedVulnerability-related.PatchVulnerabilityupdates through Safe Browsing , and our abuse team is working to prevent this kind of spoofingAttack.Phishingfrom happening again . We encourage users to report phishing emails in Gmail . If you think you were affected , visit http : //g.co/SecurityCheckup '' Those who have already fallen victim to this attack should also go to their Google account permissions settings and revoke access to the false `` Google Docs '' application . They 're also advised to set up two-factor authentication .
Cyber security researchers on Monday pointed to code in a "ransomware" attackAttack.Ransomthat could indicate a link to North Korea . Symantec and Kaspersky Lab each cited code that was previously used by a hacker collective known as the Lazarus Group , which was behind the high-profile 2014 hack of Sony that was also blamed on North Korea . But the security firms cautioned that it is too early to make any definitive conclusions , in part because the code could have been merely copied by someone else for use in the current event . The effects of the ransomware attackAttack.Ransomappeared to ease Monday , although thousands more computers , mostly in Asia , were hitAttack.Ransomas people signed in at work for the first time since the infections spread to 150 countries late last week . Health officials in Britain , where surgeries and doctors ' appointments in its national health care system had been severely impacted Friday , were still having problems Monday . But health minister Jeremy Hunt said it was `` encouraging '' that a second wave of attacks had not materialized . He said `` the level of criminal activity is at the lower end of the range that we had anticipated . '' In the United States , Tom Bossert , a homeland security adviser to President Donald Trump , told the ABC television network the global cybersecurity attack is something that `` for right now , we 've got under control . '' He told reporters at the White House that `` less than $ 70,000 '' has been paid as ransomAttack.Ransomto those carrying out the attacks . He urged all computer users to make sure they installVulnerability-related.PatchVulnerabilitysoftware patches to protect themselves against further cyberattacks . In the television interview , Bossert described the malware that paralyzed 200,000 computers running factories , banks , government agencies , hospitals and transportation systems across the globe as an `` extremely serious threat . '' Cybersecurity experts say the hackers behind the `` WannaCry '' ransomware , who demandedAttack.Ransom$ 300 paymentsAttack.Ransomto decrypt files locked by the malware , used a vulnerability that came from U.S. government documents leaked online . The attacks exploitedVulnerability-related.DiscoverVulnerabilityknown vulnerabilities in older Microsoft computer operating systems . During the weekend , Microsoft president Brad Smith said the clandestine U.S. National Security Agency had developed the code used in the attack . Bossert said `` criminals , '' not the U.S. government , are responsible for the attacks . Like Bossert , experts believe Microsoft 's security patch releasedVulnerability-related.PatchVulnerabilityin March should protect networks if companies and individual users install it . Russian President Vladimir Putin said his country had nothing to do with the attack and cited the Microsoft statement blaming the NSA for causing the worldwide cyberattack . `` A genie let out of a bottle of this kind , especially created by secret services , can then cause damage to its authors and creators , '' Putin said while attending an international summit in Beijing . He said that while there was `` no significant damage '' to Russian institutions from the cyberattack , the incident was `` worrisome . '' `` There is nothing good in this and calls for concern , '' he said . Even though there appeared to be a diminished number of attacks Monday , computer outages still affected segments of life across the globe , especially in Asia , where Friday 's attacks occurred after business hours . China China said 29,000 institutions had been affected , along with hundreds of thousands of devices . Japan 's computer emergency response team said 2,000 computers at 600 locations were affected there . Universities and other educational institutions appeared to be the hardest hit in China . China 's Xinhua News Agency said railway stations , mail delivery , gas stations , hospitals , office buildings , shopping malls and government services also were affected . Elsewhere , Britain said seven of the 47 trusts that run its national health care system were still affected , with some surgeries and outpatient appointments canceled as a result . In France , auto manufacturer Renault said one of its plants that employs 3,500 workers stayed shut Monday as technicians dealt with the aftermath of the Friday attacks . Security patches Computer security experts have assured individual computer users who have kept their operating systems updated that they are relatively safe , but urged companies and governments to make sure they applyVulnerability-related.PatchVulnerabilitysecurity patches or upgradeVulnerability-related.PatchVulnerabilityto newer systems . They advised those whose networks have been effectively shut down by the ransomware attackAttack.Ransomnot to make the payment demandedAttack.Ransom, the equivalent of $ 300 , paidAttack.Ransomin the digital currency bitcoin . However , the authors of the "WannaCry" ransomware attackAttack.Ransomtold their victims the amount they must payAttack.Ransomwill double if they do not comply within three days of the original infection , by Monday in most cases . The hackers warned that they will delete all files on infected systems if no paymentAttack.Ransomis received within seven days .
WASHINGTON — President Donald Trump ’ s homeland security adviser said Monday that the malware that has infected 300,000 computers in 150 countries is “ in the wild , ” but so far has not infiltrated U.S. government systems . Tom Bossert , assistant to the president for homeland security and counterterrorism , said three variants of the malware have been discovered and the U.S. government was closely monitoring the situation with officials in Britain . “ Overall , the U.S. infection rate has been lower than many parts of the world , but we may still see significant impacts in additional networks as these malware attacks morph and change , ” Bossert told reporters at the White House . “ We had a small number of affected parties in the U.S. , including FedEx . As of today , no federal systems are affected. ” Computers across the world were locked up Friday and users ’ files held for ransomAttack.Ransomwhen dozens of countries were hitAttack.Ransomin a cyber-extortion attackAttack.Ransomthat targeted hospitals , companies and government agencies . Cybersecurity experts say the unknown hackers who launched the “ransomware” attacksAttack.Ransomused a hole in Microsoft software that was discovered by the National Security Agency and exposed when NSA documents were leakedAttack.Databreachonline . The Department of Homeland Security is taking the lead on the investigation in the United States . The Cyber Threat Intelligence Integration Center is keeping the U.S. government informed about classified information concerning the investigation , he said . If Americans follow the patching information issued by the FBI , Microsoft and the Homeland Security Department , they will be protected from the malware and the variants , Bossert said . “ While it would be satisfying to hold accountable those responsible for this hack — something that we are working on quite seriously — the worm is in the wild , so to speak at this point , and patching is the most important message as a result , ” he said . “ Despite appearing to be criminal activity intended to raise money , it appears that less than $ 70,000 has been paid in ransomsAttack.Ransomand we are not aware of paymentsAttack.Ransomthat have led to any data recovery. ” Neither the FBI or NSA would comment Monday . Trump signed an executive order on Friday aimed at boosting the nation ’ s cybersecurity , as well as building and maintaining “ a modern , secure , and more resilient executive branch IT architecture. ” “ The trend is going in the wrong direction in cyberspace , and it ’ s time to stop that trend and reverse it on behalf of the American people , ” Bossert said after that signing last week . “ We have seen increasing attacks from allies , adversaries , primarily nation-states , but also non-nation-state actors , and sitting by and doing nothing is no longer an option. ” Homeland Security Advisor Tom Bossert announces May 11 that Trump signed an executive order to bolster the government 's cyber security and protect the nation 's critical infrastructure from cyber attacks , during a news briefing at the White House in Washington , D.C .
Valentine ’ s Day is fast-approaching and the story goes that if Cupid hits you with his golden arrow you ’ ll fall madly in love . But there are other actors taking aim at you on Valentine ’ s Day whose arrows you need to avoid as the outcomes aren ’ t nearly as desirable . Think back to early February 2016 , when many online florists experienced a surge in traffic that wasn ’ t due simply to a rush to buy flowers . Dozens of florists were hitAttack.Ransomby targeted DDoS attacks during their busiest time of the year , causing problems for some and knocking others offline who were asked to pay a ransomAttack.Ransombefore they could resume operations . It ’ s fairly typical for bad actors to escalate extortion-based campaignsAttack.Ransomduring seasonal events when the stakes for targets are high . Looking to profit with minimal investment , attackers exploit known vulnerabilities as they attempt to breach systems . For example , the 2016 Valentine ’ s Day DDoS attacks used Shellshock , a critical vulnerability that ’ s present inVulnerability-related.DiscoverVulnerabilityLinux , UNIX and Mac OS X that had been discoveredVulnerability-related.DiscoverVulnerabilitymore than a year earlier . Of course , online florists are not alone when it comes to being targeted by cyber criminals . Different times of the year and major news events can trigger a surge in attacks aimed at particular industries and geographies . Organisations need to understand their threat model and apply security processes as appropriate . Threat actors will continue to take advantage of events to launch attacks , but you can avoid their arrows this Valentine ’ s Day .