The WCry ransomware worm has struck again, this time prompting Honda Company to halt production in one of its Japan-based factories after finding infections in a broad swath of its computer networks, according to media reports.

Honda officials didn't explain why engineers found WCry in their networks 37 days after the kill switch was activated. One possibility is that engineers had mistakenly blocked access to the kill-switch domain. That would have caused the WCry exploit to proceed as normal, as it did in the 12 or so hours before the domain was registered. Another possibility is that theWCry traces in Honda's networks were old and dormant, and the shutdown of the Sayama plant was only a precautionary measure. In any event, the discovery strongly suggests that as of Monday, computers inside the Honda network had yet to install a highly critical patch thatMicrosoft released in March.

In May, it was hard to excuse so many companies not yet applying a two-month-old patch to critical systems that were vulnerable to advanced NSA exploit code put into the public domain. The failure is even harder to forgive five weeks later, now that WCry's wake of destruction has come into full view.

Read the original:

Honda shuts down factory after finding NSA-derived Wcry in its networks - Ars Technica