You can watch as these bitcoin wallets receive ransomware payments from the ongoing global cyberattack by Keith Collins

An ongoing ransomware attack that affected more than 45,000 systems on Friday has spread to 74 countries, locking doctors in the U.K. out of patient records and reportedly forcing emergency rooms to send patients to other hospitals. The attack has also reportedly hit a Spanish telecommunications company and a Russian cellphone operator.

Security experts say the strain of ransomware being used, called the “Wanna Decryptor,” is exploiting a vulnerability in Microsoft Windows that was leaked last month by an anonymous hacker group calling itself the Shadow Brokers. The group claimed it had stolen the exploits it released from the US National Security Agency.

Ransomware is a form of malware that encrypts a computer’s files and displays a message to the user, saying it will decrypt the files for a payment, typically via bitcoin. The message displaying on NHS computers and others has been circulated in photos on social media, and it includes instructions to send $300 or $600 to a bitcoin address.

Those bitcoin addresses are publicly accessible, and you can view their associated wallets as victims send the hackers money in hopes of regaining access to their files. Note that these addresses have been collected from photos on social media, and although they’ve widely been accepted by experts as genuine, Quartz has not seen the affected computers firsthand.

Here are three of those bitcoin wallets, and their associated transactions:

Wallet 1 (12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw)

Just got to Frankfurt and took a picture of this… #Sbahn, you got a #Ransomware! pic.twitter.com/w0DODySL0p

— Marco Aguilar (@Avas_Marco) May 12, 2017

This wallet has received 8 payments totaling 1.33236738 in bitcoin ($2,274.56 USD) at the time of this post’s publication. The ransomware associated with this address demands payments of $300. You can view all of its transactions here.

Wallet 2 (13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94)

A ransomware spreading in the lab at the university pic.twitter.com/8dROVXXkQv

— 12B (@dodicin) May 12, 2017

This wallet has received 13 payments totaling 2.41710431 in bitcoin ($4,126.38 USD) at the time of this post’s publication. The ransomware associated with this address demands payments of $300. You can view all of its transactions here.

Wallet 3 (115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn)

BREAKING: Multiple NHS trusts across UK under malware attack. Actual screenshot of the threat ppl are seeing: https://t.co/ZBm6a7ImwQ pic.twitter.com/7NVy8xvfyD

— Shaun Lintern (@ShaunLintern) May 12, 2017

This wallet has received 7 payments totaling 1.00701804 in bitcoin ($1,719.14 USD) at the time of this post’s publication. The ransomware associated with this address demands payments of $300. You can view all of its transactions here.

In total, across these three wallets, there have been 28 payments totaling $8,120.08.

Send us more bitcoin addresses

We are attempting to track bitcoin wallets associated with this attack that we’re able to find. If you know of a bitcoin address not listed here, please send it to kc@qz.com or tweet it to @collinskeith, along with a photo of the associated ransomware message.

Advertisements

Tagged: , , , , ,

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: