Motherboard has retracted this story: “Correction: This piece was based on the premise that a new piece of WannaCry ransomware spread in the same manner as the one that was responsible for widespread attacks on Friday, and that it did not contain a so-called kill switch. However, after the publication of this article one of the researchers making this claim, Costin Raiu, director of global research and analysis team at Kaspersky Lab, realized that was not the case. The ransomware samples without the kill switch did not proflierate in the same manner, and so did not pose the same threat to the public. Motherboard regrets the error.”
Yesterday, the world got a temporary respite from the virulent Wcry ransomware worm, which used a leaked NSA cyberweapon to spread itself to computers all over the world, shutting down hospitals, financial institutions, power companies, business, and private individuals’ computers, demanding $300 to reactivate them.
The respite was thanks to a sloppy bit of programming from the worm’s creator, who’d left a killswitch in the code: newly infected systems checked to see if a certain domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com) existed before attempting to spread the infection; by registering this domain, security researchers were able to freeze the worm.
But a day later, it’s back, and this time, without the killswitch. Security researchers running honeypots have seen new infections by versions of the worm that can spread even when the iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com domain is live.
“I can confirm we’ve had versions without the kill switch domain connect since yesterday,” Costin Raiu, director of global research and analysis team at Kaspersky Lab told Motherboard on Saturday.
Round Two: WannaCry Ransomware That Struck the Globe Is Back
[Joseph Cox/Motherboard]