Many sources including South Korea’s news agency Yonhap are reporting that a hacker group has threatened to launch a DDoS attack against seven South Korean banks unless they pay about 360 million won (US$315,000) in bitcoin. The hacker group, known as Armada Collective, has threatened KB Kookmin Bank, Shinhan Bank, Woori Bank, KEB Hana Bank, NH Bank and two other lenders. Zeljka Zorz reporting in Help Net Security writes: “Choi Sang-Myung, a researcher at South Korean’s Hauri Labs, noted that these latest threats might have been a consequence of the recent successful extortion attempt of South Korean web hosting provider Nayana. ... The deadline for the announced attacks was this Monday. The websites of the aforementioned banks are online and working, but whether it’s because they paid the requested amount or because they managed to twart the DDoS attacks is impossible to tell.”

— Update: New report from BBC, “Global ransomware attack causes chaos ... Companies across the globe are reporting that they have been struck by a major ransomware cyber-attack. ... Experts suggest the malware is taking advantage of the same weaknesses used by the Wannacry attack last month. ... Kaspersky Lab reported that it believed the malware was a ‘new ransomware that has not been seen before’ despite its resemblance to Petya.”

— Petya is a ransomware with an evil twist: F-Secure: “Instead of encrypting files on disk, it will lock the entire disk, rendering it pretty much useless. Specifically, it will encrypt the filesystem’s master file table (MFT), which means the operating system is not able to locate files. It installs itself to the disk’s master boot record (MBR) like a bootkit. But instead of covert actions, it displays a red screen with instructions on how to restore the system.”

— “A South Korean hosting firm just paid $1m to get their data back and that’s a huge incentive. It’s the biggest incentive you could offer to a cyber-criminal.” Andrei Barysevich at security firm Recorded Future told BBC