It has attacked hundreds of thousands of computers, security experts say, from hospital systems in the United Kingdom and a telecom company in Spain to universities and large companies in Asia.
"The global reach is unprecedented".
The attacks exploited the computers because they were running outdated versions of Microsoft's Windows operating system. "The numbers are going up; I am anxious about how the numbers will continue to grow when people go to work and turn (on) their machines on Monday morning".
"This means that as a new working week begins it is likely, in the United Kingdom and elsewhere, that further cases of ransomware may come to light, possibly at a significant scale", the NCSC said.
The attack looks like this: images appear on victims' screens demanding payment of $300 (275 euros) in the virtual currency Bitcoin, saying: "Ooops, your files have been encrypted!"
"And this most recent attack represents a completely unintended but disconcerting link between the two most serious forms of cybersecurity threats in the world today - nation-state action and organised criminal action".
The National Security Agency (NSA) alerted Microsoft about the issue three months ago and Microsoft released an upgrade that patched the flaw, but many users were yet to run it, CNN reported.
Brad Smith, Microsoft's president and chief legal officer, wrote: "This attack provides yet another example of why the stockpiling of vulnerabilities by governments is such a problem".
"An equivalent scenario with conventional weapons would be the USA military having some of its Tomahawk missiles stolen", Smith wrote.
Once inside a network the virus can then spread to other connected computers.
"The governments of the world should treat this attack as a wake up call".
Symantec said the majority of organisations affected were in Europe.
In his first public comments since the attack on Friday, Mr Hunt told Sky News: "Although we have never seen anything on this scale when it comes to ransomware attacks, they are relatively common and there are things that you can do, that everyone can do, all of us can do, to protect ourselves against them".
Countries so far hit by the attack include the UK, US, Spain, Ukraine, France, Russia, Australia, Indonesia, Singapore, India, Sweden and Norway.
French carmaker Renault was forced to stop production at sites in France, Slovenia and Romania, while FedEx said it was "implementing remediation steps as quickly as possible".
A divert remained in place for trauma, stroke and urgent heart attack treatment, where diagnostic services are required, at the Lister Hospital, part of East and North Hertfordshire NHS Trust (Midlands & East).