then demanding ransom to free the files. and tonight, investigators say new clues may be pointing to a familiar culprit. here's brian ross. >> reporter: cybersecurity researchers tracking the attack tonight, say the trail could lead to north korea. that the computer code that produced the attack with these ominous messages, the code used by north korea on attack on international banks last year. it could be someone else using the north korean code, says researchers. but the country has a long record of computer criminality. >> we have seen them steal money and information. we have seen them destroy information. >> reporter: there's still no attribution of who was behind the massive attacks. as of tonight the tally of attacks has grown. more than 300,000 in 150 countries. auto plants, offices, railroads around the road, and fedex in the u.s. were all hit. the most devastating, hospitals in great britain, where ambulances were turned away. cancer treatments and surgeries