Twitter account tracks ransom payments after cyberattack
The global ransomware attack that began on Friday 12 May has now spread to some 200,000 systems across 150 countries, according to the BBC. The ransomware in question, the Wanna Decryptor, is taking advantage of a Microsoft Windows vulnerability leaked in May. Digital news outlet Quartz has set up a Twitter account that tracks payments to the three bitcoin addresses ransom victims have been told to send money to. These bitcoin addresses are publicly-accessible and referred to as wallets. The ransomware has instructed its victims to send payments of $300 in bitcoin to regain access to their data. 
An ongoing ransomware attack that affected more than 45,000 systems on Friday has spread to 74 countries, locking doctors in the U.K. out of patient records and reportedly forcing emergency rooms to send patients to other hospitals. The attack has also hit a Spanish telecommunications company and a Russian cellphone operator.

Security experts say the strain of ransomware being used, called the “Wanna Decryptor,” is exploiting a vulnerability in Microsoft Windows that was leaked last month by an anonymous hacker group calling itself the Shadow Brokers. The group claimed it had stolen the exploits it released from the US National Security Agency.

Advertisement

Ransomware is a form of malware that encrypts a computer’s files and displays a message to the user, saying it will decrypt the files for a payment, typically via bitcoin. The messages displaying on NHS computers and others have been circulated in photos on social media, and include instructions to send $300 or $600 to one of three bitcoin addresses.

Those three address, experts have discovered, were hard-coded into the malware. And like all bitcoin addresses, they’re tied to publicly-accessible accounts, typically called wallets. The wallets show each payment victims have sent in hopes of regaining access to their files.

Ransom payments in realtime

We’ve setup a Twitter bot to watch each of the three wallets and tweet every time they receive new payments. It will also tweet the total amount the wallets have received every couple of hours. You can follow it at @actual_ransom.

Advertisement

Below are more details on the three bitcoin wallets. At the time of this post’s last update, they’ve collectively received 93 payments totaling $27,407.85.

Wallet 1 (12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw)

This wallet has received 38 payments totaling 6.80581381 in bitcoin ($12,039.48 USD) at the time of this post’s last update. You can view all of its transactions here.

Wallet 2 (13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94)

Advertisement

This wallet has received 35 payments totaling 5.00218759 in bitcoin ($8,848.87 USD) at the time of this post’s last update. You can view all of its transactions here.

Wallet 3 (115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn)

This wallet has received 30 payments totaling 3.64134512 in bitcoin ($6,470.67 USD) at the time of this post’s last update. You can view all of its transactions here.

This article was updated with new numbers and details on May 13 at 8:00 p.m. EDT.