Petya, A New Ransomware That's Worse Than WannaCrypt, Is Spreading Fast Across Europe & The US
Referred to as Petya, the new malware may eventually turn out to be even more nefarious than WannaCry.
Just a few short weeks after WannaCrypt raged across the world, another brand of ransomware is wreaking havoc across Europe, and has now begun spreading to the US.
Cybersecurity researchers at Symantec and other firms have confirmed that the new ransomware, called ¡®Petya¡¯, is being spread using EternalBlue, the exploit leaked in April by hacker group ShadowBrokers. EternalBlue is just one of many exploits and vulnerabilities utilised by the US National Security Agency in its spying campaigns.
The #Petya #ransomware is back using the #EternalBlue exploit - and our #Antivirus customers are protected! #infosec pic.twitter.com/fWap1rRLeA
¡ª Avira (@Avira) 27 June 2017
According to Reuters, the first reports of organizations being hit emerged from Russia and the Ukraine, but quickly spread to Romania, the Netherlands, Norway, and Britain. Not just individuals, but a number of major corporations have begun reporting that they¡¯ve been locked out of their systems by Petya. WPP, one of the biggest advertising agencies in the world, was hit worst by the ransomware attack, though other European media content groups have also been crippled.
#CyberAttack Massive ransomware attack is causing chaos in airports, banks and private companies worldwide @WPP, @admeira_ch, @ufomedia pic.twitter.com/oLXsZC9DER
¡ª Mediabeobachter (@mediabeobachter) 27 June 2017
#Ransomware attack hit #WPP. Whole group told to disconnect phones from wi-fi and shut down computers immediately.
¡ª LlaM4DramA (@LlaM4DramA) 27 June 2017
We can confirm that Maersk IT systems are down across multiple sites and business units. We are currently assessing the situation.
¡ª Maersk (@Maersk) 27 June 2017
Other victims of the ransomware include Ukraine¡¯s central bank, state telecom and municipal metro facilities, and even the Kiev airport. It doesn¡¯t stop there, as reports are emerging the Chernobyl nuclear power plant has switched to manual monitoring, after a few computers there were infected by the malware.
An infected ATM of Ukraine
Just called my father. He says he couldn't buy fuel at a petrol station, the system is shut down.
¡ª Kateryna_Kruk (@Kateryna_Kruk) 27 June 2017
Everyone is disoriented.
"The Ukraine cabinet of ministers seems to also have been hacked. The network is down" says deputy PM. This is turning into 1 hell of a hack https://t.co/nnZrcDgOoq
¡ª Alec Luhn (@ASLuhn) 27 June 2017
Microsoft has long since released a patch for EternalBlue, so if you¡¯ve updated your home computer you¡¯re safe. This is one situation where larger corporations are at a higher risk. However, on the off chance your system does get infected, you might have to live with the fact that you¡¯ll never see your files again.
How's Petya ransomware spreading
You see, the ransomware¡¯s creators have placed a message that flashes on an infected computer¡¯s screen, demanding they pay $300 in Bitcoins to a specific account. Once that¡¯s done, the victim sends a confirmation and their personal installation key (the unique ID displayed in the message) to a specific email. So Posteo, the Berlin-based email provider from whose service the ransomware creators have been keeping in touch with their victims, went ahead and blocked the ID. ¡°We do not tolerate any misuse of our platform: The intermittent blocking of abused mailboxes is a normal procedure of providers in such cases,¡± the company said in an announcement. Of course, what that also means is that there¡¯s no point to paying out anymore; the victims can¡¯t contact the perpetrators, and therefore can¡¯t get their files decrypted. It¡¯s all gone.
However, there¡¯s another nugget of information to consider. Though this ransomware is being referred to as Petya, that¡¯s actually the name of a ransomware from 2016. While the new entry is definitely a strain of it¡¯s name-sharing ancestor, and definitely follows in the footsteps of WannaCry, there are a few identifiable differences.That, coupled with the fact that the perpetrators used an easily blocked email address is leading some cybersecurity experts to believe there¡¯s more than meets the eye.
Correct. They modelled it after Petya but it's not actually Petya. I doubt intent was actually ransomware, too easy to close email acct. https://t.co/lBZlVFrbTX
¡ª Kevin Beaumont (@GossiTheDog) 27 June 2017
In the meantime, don¡¯t expect a repeat of WannaCry with ¡°NotPetya¡±; the likelihood of this second ransomware having a hidden kill-switch is extremely low. Instead we might just have to sit tight and weather the coming storm.
