What is Petya ransomware? How it can be stopped?

You might have heard of the recent ransomware attacks worldwide by ‘WannaCry’ which locked out many users out of their computers and asked for a Bitcoin equivalent to $300. However, it looks like it was just the beginning of a series of cyber attacks. The WannaCry or WannaCrypt ransomware attack affected more than 230,000 computers in over 150 countries, with the NHS, Spanish phone company Telefónica and German state railways among those hardest hit. What’s Next? Heard of Petya ransomware yet? Let us start from the very beginning.

What is Ransomware?

Ransomware is a type of malware that blocks access to a computer or its data and demands money to release it.

How does it work?

Ransomware encrypts important documents and files and then demands a ransom in Bitcoin, for a digital key needed to unlock the files. If victims don’t have a recent back-up of the files they must either pay the ransom or face losing all of their files.

What is Petya ransomware?

According to Wikipedia “Petya” is a family of encrypting ransomware that was first discovered in 2016. The malware targets Microsoft Windows-based systems, infecting the master boot record to execute a payload that encrypts the NTFS file table, demanding a payment in Bitcoin in order to regain access to the system.”

Petya was first discovered in March 2016, which propagated via infected e-mail attachments. The new variant propagates via the EternalBlue exploit, which is generally believed to have been developed by the U.S. National Security Agency (NSA), and was used earlier in the year by the WannaCry ransomware. Although it purports to be ransomware, this variant was modified so that it is unable to actually revert its own changes.”

Although it is not the same ransomware, this variant of Petya ransomware was modified to be more lethal than WannaCry. This variant was modified so that it is unable to revert its own changes.

It’s worse than WannaCry, it’s wiper pretending to be ransomware.

Where did it start?

Security researchers and Ukraine’s cyber police are pointing fingers at MeDoc, a third-party accounting software product, used by many industries in Ukraine including financial institutions. MeDoc pushed out an update which was then compromised by hackers. When this was installed, computer networks got this malware. The second wave of infections was circulated by a phishing campaign featuring malware-laden attachments.

Why is it called “Petya”?

This malware appears to have a similar code as an older piece of ransomware that really was called Petya. But hours after the outbreak security researchers noticed that the code has been modified. Researchers at Russia’s Kaspersky Lab redubbed the malware NotPetya. On top of that, other researchers who independently spotted the malware gave it other names: Romanian’s Bitdefender called it Goldeneye, for instance.

Who has been hit?

Microsoft estimates over 12,000 machines have been hit by the cyber attack. Reports suggest that the malware has spread across the U.S., large parts of Europe, South America, and big countries in Asia too.

Major corporations have also been affected including WPP, Maersk, Russian oil giant Rosneft, and public and private institutions in Ukraine.

WPP said that it has taken steps to contain the attack with the priority now to return to normal operations. Many of the businesses under the WPP brand were affected but they are “experiencing no or minimal disruption.”

Maersk said that IT systems were down across multiple sites and some business units, but the issues have been contained. It is now working on a “technical recovery plan”. The impact on the business is still being assessed.

Russia, which was one of the countries hit, said the cyber attack caused no serious problems at either a state or corporate level in the country.