|
A new variant of Petya ransomware, also known as Petrwrap, NotPetya,
or GoldenEye, is spreading rapidly with the help of the same Windows
SMBv1 vulnerability that the WannaCry ransomware abused to infect
300,000 systems and servers worldwide in just 72 hours. Petya
ransomware has been delivered via phishing emails pretending to
provide a resume which is, in fact, a malicious dropper. Make sure
your users are aware of the risks of opening attachments from unknown
sources.
The malware appears to share a significant amount of code with an
older piece of ransomware that really was called Petya, but in the
hours after the outbreak started, security researchers noticed that
�the superficial resemblance is only skin deep�. Researchers at
Russia�s Kaspersky Lab redubbed the malware NotPetya, and increasingly
tongue-in-cheek variants of that name Petna, Pneytna, and so on began
to spread as a result. On top of that, other researchers who
independently spotted the malware gave it other names.
The attack started in
Ukraine and caused massive disruption to the country�s critical
infrastructure, before spreading further in Europe, infecting a number
of businesse.The goal of a wiper is to destroy and damage. The goal of
a ransomware is to make money. Different intent. Different motive.
Different narrative. A ransomware has the ability to restore its
modification such as a wiper would simply destroy and exclude
possibilities of restoration
Spreading Petya according
to countries. (Figure 1)
Petya was discovered in March 2016.Check Point noted that while it had
achieved fewer infections than other active ransomware in early 2016,
such as CryptoWall, which contained notable differences in the
operation that made it immediately marked as the next Step In the
evolution of the rescue. Another variant of Petya discovered in May
2016 contained a secondary payload used if malware can not gain access
at the administrator level.
The Petya ransomware attack has spread from Ukraine to different parts
of Europe (Spain, Netherlands, Denmark etc) and to India as well. It�s
reported that the hackers behind this malware are asking for a ransom
of $300 in Bitcoin. It�s also reported that they have already started
getting their payment and that the ransom payment this time happens
faster than it happened with WannaCry.
How to Prevent
Most major antivirus companies now claim that their software has
updated to actively detect and protect against �Petya� infections:
Symantec products using definitions version 20170627.009 should, for
instance, and Kaspersky also says its security software is now capable
of spotting the malware. Additionally, keeping Windows up to date at
the very least through installing March�s critical patch defending
against the EternalBlue vulnerability stops one major avenue of
infection, and will also protect against future attacks with different
payloads.
For this particular malware outbreak, another line of defence has been
discovered: �Petya� checks for a read-only file, C:\Windows\perfc.dat,
and if it finds it, it won�t run the encryption side of the software.
But this �vaccine� doesn�t actually prevent infection, and the malware
will still use its foothold on your PC to try to spread to others on
the same network.
References
1. http://fortune.com/2017/06/27/petya-ransomware-cyber-attack/
2. https://www.theverge.com/2017/6/28/15888632/petya-goldeneye-ransomware-cyberattack-ukraine-russia
3. https://blog.comae.io/petya-2017-is-a-wiper-not-a-ransomware-9ea1d8961d3b
By
Supun Buddika Fernando
Buddika is an undergraduate of Sri Lanka Institute of Information
Technology who is currently following BSc(Hons) IT Specializing Cyber
Security. Currently he is working as Intern - Information Security
Engineer at Sri Lanka CERT|CC
| 
