We highlight current cyber security threats in New Zealand, and provide guidance on what to do if they affect you.
TLP Rating: White
This advisory has been updated from our original post on 13 May 2017. If you would like a copy of the previous version of our advice, please email comms@cert.govt.nz.
A massive international ransomware campaign hit computer systems of private companies and public organisations around the world. This incident is being reported as the largest ransomware campaign to date. The Ransomware in question has been identified as a variant of ransomware known as WannaCry (also known as 'Wana Decrypt0r,' 'WannaCryptor' or 'WCRY'), because the encrypted files extension is .wcry. Like other ransomware, WannaCry also blocks access to a computer or its files and demands money to unlock it. Early reports were that the ransom demanded was around $430NZD, though this may change over time.
There are reports of infection via a phishing email however these have not been confirmed. The ransomware has spread quickly via a vulnerability in machines running unpatched versions of Windows (XP through 2008 R2) by exploiting flaws in Microsoft Windows SMB Server. Once a single computer in a network is infected with WannaCry, the program looks for other vulnerable computers on the network and infects them as well.
This ransomware exploits a Windows vulnerability known as EternalBlue External Link
, which was released by the Shadow Brokers hacking group over a month ago. Microsoft released a patch for the vulnerability in March (MS17-010) External Link .
, including Windows XP and Server 2003. Microsoft doesn’t officially provide support to these systems any longer, but have released this patch in response to the WannaCry spread. The details on this release are relatively new and more information is coming to light constantly. For organisations that require further support or more specified advice, please log an incident on our website at cert.govt.nz. Similarly, if you have been compromised with this ransomware, please contact CERT NZ.