Security News Telefonica Tells Employees to Shut Down Computers Amid Massive Ransomware Outbreak

[frogboy]

A ransomware outbreak is wreaking havoc all over the world, but especially in Spain, where Telefonica — one of the country's biggest telecommunications companies — has fallen victim, and its IT staff is desperately telling employees to shut down computers and VPN connections in order to limit the ransomware's reach.

The culprit for these attacks is v2.0 of the WCry ransomware, also known as WannaCry or WanaCrypt0r ransomware.

WCry ransomware explodes in massive distribution wave
Version 1.0 of this ransomware was discovered by Malwarebytes researcher S!Ri on February 10 and then spotted in a brief campaign on March 25 by GData security researcher Karsten Hahn.

Version 2.0 was detected for the first time around four hours ago by independent security researcher MalwareHunter. The security researcher says the ransomware came out of nowhere and started spreading like wildfire.

In these first four hours, WCry 2.0 made more victims than Jaff, a ransomware spotted this week distributed via the Necurs botnet, the former home of the Locky ransomware. In numbers, in just four hours WCry made 1.5 times more victims than Jaff did all week.

Currently, researchers weren't able to pinpoint the exact origin of the WCry distribution campaign. At the moment, it could be from malvertising, exploit kits, email spam, or hand-cranked RDP attacks.

WCry outbreak making high-profile victims in Spain

Read More. Telefonica Tells Employees to Shut Down Computers Amid Massive Ransomware Outbreak

 

[brambedkar59]

It must have happened because some employee wanted to view a certain document sent to him by email claiming he got a parcel waiting for him in the local post office filled with God knows what hidden jewels. Just kidding.
Nowadays Ransomwares are getting pretty much the king of Malware family.
I personally don't find Ransomware that scary (because of the backups both online and offline), also maybe because I have never been hit by one till now.
What I truly find scary are the keyloggers in those damn Rootkits (worst part is that you don't even know that you have been screwed over). I was hit by one several years ago, and had to change every damn password I had ever used online on that pc
Rootkits were one of the reasons why I switched to 64 Bit OS.

 

[frogboy]

@Sr. Normal 2.0 are you affected by this. I hope not.

 

[HarborFront]

So, a dedicated anti-ransomware software is still needed besides other security software

 

[Sr. Normal 2.0]

@Sr. Normal 2.0 are you affected by this. I hope not.

No, thanks my dear friend, i´m with other company, but Telefónica is the first telephone and internet operator and here people is nervous.

 

[Peter2150]

So, a dedicated anti-ransomware software is still needed besides other security software

I don't believe that to be the case, unless you still take the traditional approach.... I don't

 

[HarborFront]

I don't believe that to be the case, unless you still take the traditional approach.... I don't

Then Telefonica should have bought AppGuard + ReHIPS for their use, right?

 

[ttto]

No, thanks my dear friend, i´m with other company, but Telefónica is the first telephone and internet operator and here people is nervous.

Just a few months ago, I went from Telefonica (Movistar) to other ISP. I better service and prize now. I hope Telefonica fix this soon.

 

[harlan4096]

We should know which antivirus firm are They using to protect their systems...

 

[Nuno]

Afaik the most affected countries are Spain, Portugal and the UK.
So far it's confirmed that Spanish "Telefonica", Portuguese "Portugal Telecom" and a UK Hospital were attacked. With Telefonica, the Ransomware spread to Chilean and Argentinian Telefonica subsidiaries. However, I don't think these have affected the customers in any way.
There are also rumors about it having reached several iberian banks even though it's not known for sure.
Finally I've heard some really sketchy rumors about people claiming it was putting the ATM system at risk but I don't believe that's the case.

 

[Arequire]

We should know which antivirus firm are They using to protect their systems...

Fortinet is employed widely in many NHS Trusts including mine.

 

[Winter Soldier]

The fact is that every device connected to the Internet is a potential attack vector.
Of course the security technology exists, but only rarely it is fully used. This often depends on the availability of money to invest in infrastructure and quality, but also and especially by the “sensitivity”, towards a culture of safety and a level of awareness on the risks and threats to which the company is exposed.
The IT manager, if present, must always be "up to date" on the best strategies to adopt for the protection of data, information, networks, and systems. The companies choose in many cases to entrust their IT security to external companies but it is always more difficult to deal with advanced attack scenarios that exploit vulnerability and weakness of the individual users.

 

[brod56]

It must have happened because some employee wanted to view a certain document sent to him by email claiming he got a parcel waiting for him in the local post office filled with God knows what hidden jewels. Just kidding.
Nowadays Ransomwares are getting pretty much the king of Malware family.
I personally don't find Ransomware that scary (because of the backups both online and offline), also maybe because I have never been hit by one till now.
What I truly find scary are the keyloggers in those damn Rootkits (worst part is that you don't even know that you have been screwed over). I was hit by one several years ago, and had to change every damn password I had ever used online on that pc
Rootkits were one of the reasons why I switched to 64 Bit OS.

Joking or not, most ransomware network infections are started because someone opened a stupid e-mail

 

[orphyone]

Just a thought, BTC or Bitcoin has skyrocketed to $1760.46 USD from $1200 a few weeks ago. Methinks this to be related (not NHS but outbreak on whole).

And a Bitcoin Is Now Worth...

 

[legendcampos]

The attack arrived in my country (Brazil), many computers were locked!

 

[Peter2150]

Indeed if they had Appguard on board, they probably would have been protected.

 

[orphyone]

Just a thought, BTC or Bitcoin has skyrocketed to $1760.46 USD from $1200 a few weeks ago. Methinks this to be related (not NHS but outbreak on whole).

And a Bitcoin Is Now Worth...

Actually the more I think about this the more it makes sense since Ransomware payments are in BTC usually, it would make sense to drive BTC up to crazy levels then carryout a huge Ransomware campaign for massive amounts more profit.

 

[ElectricSheep]

Telefonica doesn't just affect Spain, it also owns one of the biggest telecommunications firms in the UK - O2. Theres every possibility that they could be affected too

 

[Game Of Thrones]

if you look at the evidence here, many security apps that rely on machine learning(I know some of the machine learning is just a hype and ad)show that they could have prevented this from happening, look at virus total even though that many companies detect without showing the detection in virus total, but even at the first stage IMO big companies like trend or Symantec that have more data to proccess than the others show promising performance in detection and prevention. specially Symantec which you can see in recent reports that they really upped their detection based on behaviour and analysis or CROWDSTRIKE , SentinelOne,... . so I think if they used something good in security industry I'm not goona say they would not be affected but the damage control was easier and the area of effect would be much less IMO.

 

[kodesilo]

which vendor can detect and remove this outbreak?