The massive WannaCry ransomware is not dead yet and another large scale ransomware attack is making chaos worldwide, infecting and shutting down Machines at scale. A new malware called “Petya Ransomware” or “Petwrap Ransomware” attacked many of the computers at banks, businesses, power supplies, and banks across Russia, Ukraine, Spain, France, UK, India, and Europe and demanding $300 in bitcoins.
According to sources, the malware is spreading rapidly with the help of same Windows SMBv1 vulnerability that the WannaCry ransomware has misused earlier in May 2017 to infect 300,000 computers worldwide in just 72 hours.
What is Petya Ransomware?
Petya is a nasty piece of ransomware and works very differently from any other ransomware malware. Unlike other traditional ransomware, Petya does not encrypt files on a targeted system one by one.
Instead, Petya reboots victims computers and encrypts the hard drive’s master file table (MFT) and renders the master boot record (MBR) inoperable, restricting access to the full system by seizing information about file names, sizes, and location on the physical disk.
Petya ransomware replaces the computer’s MBR with its own malicious code that displays the ransom note and leaves computers unable to boot. According to Security Research firm Kaspersky, Petya could be a variant of Petya.A, Petya.D, or PetrWrap.
How is Petya Ransomware Affecting?
Petya ransomware is spreading over the Microsoft Windows SMB protocol. It uses the Eternalblue exploit tool, which exploits CVE-2017-0144. Just like Wannacry, it is taking advantage of unpatched Windows machines.
“Petya uses the NSA Eternalblue exploit but also spreads in internal networks with WMIC and PSEXEC. That’s why patched systems can get hit.” Mikko Hypponen, Chief Research Officer at F-Secure, has tweeted.
After the system is compromised, the victim is asked to send US $300 in Bitcoin to a specific Bitcoin address and then send an e-mail to them with the victim’s Bitcoin wallet ID to retrieve their individual decryption key.
The victim’s computer is displayed with a message saying, “If you see this text, then your files are no longer accessible because they are encrypted. Perhaps you are busy looking for a way to recover your files, but don’t waste your time. Nobody can recover your files without our decryption service.”
Petya Ransomware Hits Banks, Businesses, and Telecom Companies
In past few hours, Petya ransomware has already infected Russian state-owned oil giant Rosneft, Ukrainian state electricity suppliers, “Kyivenergo” and “Ukrenergo.” There are also reports from several banks, including National Bank of Ukraine (NBU) and Oschadbank, confirming they have been hit by the Petya ransomware attacks.
Maersk, an international logistics company, has also confirmed on Twitter that the latest Petya ransomware attacks have shut down its IT systems at multiple locations and business units. Three Ukrainian telecommunication operators, Kyivstar, LifeCell, Ukrtelecom, are also affected by the latest Petya attack.
The most severe damages reported by Ukrainian businesses also include compromised systems at Ukraine’s local metro and Kiev’s Boryspil Airport.
How To Prevent Infection from Petya Ransomware?
Security researchers found that Petya ransomware encrypts systems after rebooting the computer. So if your system is infected with Petya ransomware and it tries to restart, just power it off immediately.
“If machine reboots and you see this message, power off immediately! This is the encryption process. If you do not power on, files are fine,” HackerFantastic tweeted.
Attacked by Petya Ransomware? Here’s What You Should do:
Infected users are advised not to pay the ransom because hackers behind Petya ransomware can’t get your emails anymore. So, even if you pay, you wouldn’t get your files back.
Posteo, the German email provider, has suspended the email address (wowsmith123456@posteo.net) used by attackers to communicate with victims to receive the decryption keys.
How to Protect Yourself from Any Ransomware Attacks?
- Apply security updates in MS17-010
- Disable the unsecured SMBv1 file-sharing protocol on your Windows systems and servers.
- Block inbound connections on TCP Port 445
- Create and maintain good back-ups so that if an infection occurs, you can restore your data.
- Make sure that you run a good and effective anti-virus security suite on your system.
- Most importantly, always browse the Internet safely.
Hello, my name is Laiker Attacker. I'm a 23 year old Developer Webs Design Graphic 4D And Write News from the United State.
No comments:
Post a Comment