Reuters Exclusive: Wannacry hits Russian postal service, exposes wider security shortcomings
Russia's postal service was hit by Wannacry ransomware last week and some of its computers are still down, three employees in Moscow said, the latest sign of weaknesses that have made the country a major victim of the global extortion campaign, according to Reuters.
Wannacry compromised the post office's automated queue management system, infecting touch-screen terminals which run on the outdated Windows XP operating system, one of the workers said. Terminals were still blank in some parts of Moscow this week but it was not clear exactly how many branches had been affected, Reuters reported.
A spokesman for Russian Post, a state-owned monopoly, said no computers were infected, but some terminals were temporarily switched off as a precaution. "The virus attack did not touch Russian Post, all systems are working and stable," he said.
Other institutions in Russia have said they were infected by the virus, highlighting Moscow's readiness to show it too is a frequent victim of cyber crime in the face of allegations from the United States and Europe of state-sponsored hacking.
Read alsoAnother ransomware nightmare could be brewing in Ukraine – mediaThe Interior Ministry, mobile operator MegaFon and state rail monopoly Russian Railways all reported infections, with employees locked out of their computers and the creators of the virus demanding ransoms of $300 to $600.
The Russian central bank said on Friday the virus had also compromised some Russian banks in isolated cases.
That the infected post office terminals ran on Windows XP - which Microsoft stopped supporting in 2014 - points to the widespread use of outdated software in Russia, which experts say left the country disproportionately vulnerable to the attack.
Read alsoBloomberg: New wave of ransom threats seen in unprecedented global attackOf 300,000 computers infected worldwide, 20 percent were in Russia, according to an initial estimate by cybersecurity researchers last week.
Globally, few ransoms have been paid after many victims found they could restore their systems from backups.
The post office outages also illustrate what investigators say is a common misconception about Wannacry: infected computers are more likely to be part of antiquated systems not deemed important enough to update with the latest security patches, rather than machines integral to the company's core business.
"Many companies in Russia use outdated unpatched systems and older anti-malware solutions," said Nikolay Grebennikov, vice president for R&D at data protection company Acronis. "In big companies upgrades are hard to perform and avoided because of budget and scale."