The Chernobyl nuclear power plant is among the sites hit by a new and highly virulent outbreak of malicious data-scrambling software causing mass disruption across the globe.

Some computers at the plant - which is still in the process of being decommissioned after a devastating explosion in 1986 - were infected by the virus, according reports in local media.

The virus, which appears to be a version of the "Petya" ransomware first identified in 2016, is also disrupting the Ukrainian power grid, banks and government offices.

Those behind the attack are reportedly demanding a ransom of $300 per computer to be paid in the cryptocurrency Bitcoin before they will unscramble the affected computers.

A dedicated computer team have been working to contain the situation at Chernobyl. The plant's shift director Vladimir Ilchuk told Ukranian newspaper Pravda there is no radiation threat.

He said that a radiation leak was avoided due to "excess levels of control" at the power plant. However, staff working at the plant have had to switch to monitoring radiation levels manually, as they are unable to access reports and metrics on their computers.

Russian energy company Rosneft also reported falling victim to the hacking attack, as did shipping company AP Moller-Maersk, which said every branch of its business was affected.

Ukraine's prime minister Volodymyr Groysman said the cyber attack is "unprecedented" but "vital systems haven't been affected".

He also said on Facebook that "our IT experts are doing their job and protecting critical infrastructure... The attack will be repelled and the perpetrators will be tracked down."

Ukrainian deputy prime minister Pavlo Rozenko posted a picture of a darkened computer screen on Twitter, saying the computer system at the government's headquarters has been shut down.

Meanwhile British advertising agency WPP said a number of its computers had been affected, and its website appeared to be down as it made the announcement.

US pharmaceutical company Merck, law firm DLA Piper, Netherlands-based shipping company TNT and Spanish food giant Mondelez - whose brands include Oreo and Toblerone - have also been compromised as part of the global hack.

(
Image:
Vectra Networks)

There is very little information about who might be behind the disruption.

However, technology experts who examined screenshots circulating on social media said it bears the hallmarks of ransomware - the name given to programs that hold data hostage by scrambling it until a payment is made.

It appears to be spreading using the EternalBlue vulnerability in Microsoft Windows - the same vulnerability used to spread the WannaCry ransomware, which crippled the UK's National Health Service and thousands of businesses worldwide last month.

"The Petya attack looks very similar in its dynamics and techniques to the WannaCry ransomware that caused large disruption just a few weeks ago," said Marco Cova, senior security researcher at Lastline.

"In particular, like WannaCry, it seems to rely on the EternalBlue exploit to automatically spread from one machine to another.

"If it is confirmed that the EternalBlue is the only spreading mechanism, there will be inevitable questions about how organisations could still fall to this attack after all the publicity and support tools that were produced as part of the WannaCry response."

WannaCry spread rapidly using digital break-in tools originally created by the US National Security Agency (NSA), which recently leaked to the web.

Within a day of being released, it had infected more than 230,000 computers in over 150 countries.

(
Image:
AFP)

"Last month's WannaCry attack was largely reported as the world’s largest ransomware attack, but this latest attack indicates that, only a month on, it’s possible that the trend is only set to grow," said Dr Malcolm Murphy, technology director for Western Europe at security firm Infoblox.

"While ransomware has traditionally posed a threat to consumers and their personal data, attacks such as this demonstrate that the risk to national infrastructure is far greater.

"With power grids and transport hubs at the risk of being shut down, the extent to which attacks such as these can pose a risk to national safety is abundantly clear."