An ongoing ransomware attack that affected more than 45,000 systems on Friday has spread to 74 countries, locking doctors in the U.K. out of patient records and reportedly forcing emergency rooms to send patients to other hospitals. The attack has also hit a Spanish telecommunications company and a Russian cellphone operator.
Security experts say the strain of ransomware being used, called the “Wanna Decryptor,” is exploiting a vulnerability in Microsoft Windows that was leaked last month by an anonymous hacker group calling itself the Shadow Brokers. The group claimed it had stolen the exploits it released from the US National Security Agency.
Ransomware is a form of malware that encrypts a computer’s files and displays a message to the user, saying it will decrypt the files for a payment, typically via bitcoin. The messages displaying on NHS computers and others have been circulated in photos on social media, and include instructions to send $300 or $600 to one of three bitcoin addresses.
Those three address, experts have discovered, were hard-coded into the malware. And like all bitcoin addresses, they’re tied to publicly-accessible accounts, typically called wallets. The wallets show each payment victims have sent in hopes of regaining access to their files.
Ransom payments in realtime
We’ve setup a Twitter bot to watch each of the three wallets and tweet every time they receive new payments. It will also tweet the total amount the wallets have received every couple of hours. You can follow it at @actual_ransom.
Below are more details on the three bitcoin wallets. At the time of this post’s last update, they’ve collectively received 93 payments totaling $27,407.85.
Wallet 1 (12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw)
This wallet has received 38 payments totaling 6.80581381 in bitcoin ($12,039.48 USD) at the time of this post’s last update. You can view all of its transactions here.
Wallet 2 (13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94)
This wallet has received 35 payments totaling 5.00218759 in bitcoin ($8,848.87 USD) at the time of this post’s last update. You can view all of its transactions here.
Wallet 3 (115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn)
This wallet has received 30 payments totaling 3.64134512 in bitcoin ($6,470.67 USD) at the time of this post’s last update. You can view all of its transactions here.
This article was updated with new numbers and details on May 13 at 8:00 p.m. EDT.