PARIS (AP) — The cyberattack that has locked up computers around the world while demanding a ransom may not be an extortion attempt after all, but something more sinister: an effort to create havoc in Ukraine, security experts say.

"There may be a more nefarious motive behind the attack," Gavin O'Gorman, an investigator with U.S. antivirus firm Symantec, said in a blog post . "Perhaps this attack was never intended to make money (but) rather to simply disrupt a large number of Ukrainian organizations."

The rogue program initially appeared to be ransomware, a fast-growing and lucrative breed of malicious software that encrypts its victims' data and holds it hostage until a payment is made.

But O'Gorman was one of severalresearchers who noted that any criminals would have had difficulty making money off the epidemic given that they appear to have relied on a single email address that was blocked almost immediately and a single Bitcoin wallet that, to date, has collected the relatively puny sum of $10,000.

Others, such as Russian anti-virus firm Kaspersky Lab, said that clues in the code suggest the program's authors would have been incapable of decrypting the data in any case, adding further evidence that the ransom demands were a smoke screen.

Ransomware or not, computer specialists worldwide were still wrestling with its consequences, with varying degrees of success.

Danish shipping giant A.P. Moller-Maersk, one of the global companies hardest hit by the malware, said Thursday that most of its terminals are now operational, though some terminals are "operating slower than usual or with limited functionality."

Problems have been reported across the shippers' global business, from Mobile, Alabama, to Mumbai in India. When The Associated Press visited the latter city's Jawaharlal Nehru Port Trust on Thursday, for example, it witnessed several hundred containers piled up at just two yards, out of more than a dozen yards surrounding the port.

"The vessels are coming, the ships are coming, but they are not able to take the container because all the systems are down," trading and clearing agent Rajeshree Verma told the AP. "The port authorities, they are not able to reply (to) us. The shipping companies they also don't know what to do. ... We are actually in a fix because of all this."

Moller-Maersk is one of dozens of major corporations and government agencies — from FedEx subsidiary TNT to Ukraine's banking system — to have had its services disrupted by the malware epidemic.

Even small businesses otherwise unaffected by the malware are beginning to feel the pain.

Steffan Mastek of Petersen & Soerensen, a small Danish ship repair company, said he had been forced to re-order engine parts because TNT's track-and-trace system for parcels was down.

"We had to re-order the parts that need to be fitted to a ship engine and that has to be done by Friday when the ship has to be returned," Mastek said.

Online retailers were bracing for trouble, with several emailing clients to warn of possible delays.

Enrique Frisancho, the owner of Barcelona, Spain-based smartphone accessory firm Shoulderpod, said he'd already had to resend a few items through another courier to meet clients' deadlines. Darren Hobbs, a sales adviser at the U.K.-based Tile Fix Direct, also said his customers had been alerted.

"TNT contacted us and we were advised there could possibly be delays," he said.

___

Olsen reported from Copenhagen. Manish Mehta in Nhavasheva, India, and Vladimir Isachenkov in Moscow contributed to this report.

___

A previous version of this story said that the malware epidemic occurred on the anniversary of the assassination of a senior Ukrainian military intelligence officer. This story has been corrected to note that the epidemic occurred on the day of the assassination.