Petya, the latest ransomware that attacked Europe, Asia and the United States

UPDATE: New sources indicate that Petya was modified in a way that made it behave as a wiper, directly destroying data on infected systems.

On June 27, 2017, Ukraine suffered a cyberattack that quickly spread across much of Europe and the United States. In less than 24 hours, around 300,000 computers in more than 25 countries were infected by the virus now known as "Petya".

What is Petya and how does it work?

As we have seen with other ransomware attacks, Petya blocks access to a Windows device and encrypts the files on it.

When the computer crashes, an error message known in Spanish as Blue Screen or Blue Screen of Death (DSOD) in English. The PC then restarts, but the virus prevents the operating system from loading, disrupting the booting of the hard drive. The user is kept on the MS-DOS screen, which is where the ransomware message appears. The only way for the user to recover their files is through the key that the cybercriminals have and for which they request the payment of a ransom through Bitcoins.

If the user does not pay the ransom, they will have to face the loss of the data as we saw in the WannaCry cyber attack. Another coincidence with this latest attack is that Petya victims were asked to pay a sum of $300 in Bitcoins.

How did Petya spread?

Some theories suggest that the popular accounting software, MeDoc, was hacked before it released an automatic update, so users downloaded the virus on computers that had MeDoc installed and that, in addition, They also had the EternalBlue vulnerability.

It has not yet been verified that MeDoc is the source of the Petya ransomware, although the company has already denied that it is. However, the evidence that has been found so far, point out that it has indeed been a point through which the virus has spread.

Symantec analysts have confirmed #Petya #ransomware, like #WannaCry, is using #EternalBlue exploit to spread

— Security Response (@threatintel) June 27, 2017

Shortly after being executed, the worm spread to all types of institutions: governments, banks and even infrastructures such as the Chernobyl nuclear power plant. It didn't take long to cross Europe, hitting countries like Germany, Spain, France, Russia and Great Britain. Some of the companies affected were Rosneft, Saint-Gobain, WPP, Deutsche Post and Mondelez International.

The last companies to fall victim to the Petya ransomware were Merck and DLA Piper, an American pharmaceutical company and an international law firm based in the United States. Merck is also known as one of the largest pharmaceutical companies in the world.

At Open Data Security, we have closely followed the progress of this ransomware, monitoring how many countries and companies have been affected, as well as how many payments have been made to the cybercriminals behind Petya.

Since the virus broke out, there have been 43 payments in the account that the attackers indicated for the payment of the ransom by Bitcoins. The total accumulated sum is 3.87408155 BTC, which is approximately equivalent to 9,734 dollars, 7,591 pounds or 8,565 euros.

?? 27 payments have been made since our last post. Bringing a total of 40 transactions, and 3.64053686 BTC.#petya #ransomware #cyberattack pic.twitter.com/0czGhMyOxm

— Open Data Security (@ODSops) June 28, 2017

At the moment, the Bitcoin address remains enabled and ransom payments continue to be made.

The difference between Petya and WannaCry

Petya has similar characteristics to WannaCry, but the new ransomware has spread more quickly across the network than its predecessor, which explains how the virus has spread so quickly. Unlike WannaCry, which blocked access to some files, Petya encrypts the entire hard drive. In this way, the computer becomes unusable until the system is completely disinfected.

Additionally, security experts point out the quality of Petya's code, since This improved with each iteration.. It also did not have any emergency shutdown (known as kill switch) that would cause the ransomware to shut down. Petya can continue to affect PCs that are not protected from the EternalBlue exploit, as well as carry out some actions, such as linking infected Microsoft Word documents and embedding the worm in system updates as happened to MeDoc.

What to do if you run a file with Petya?

Currently, there is no method to decrypt information on an infected PC, but there is a way to stop the encryption before the computer is infected. If a message like the one in the image below appears on the screen, turn off your computer immediately. Only then will file encryption stop.

Then boot the system with a recovery disc such as LiveCD. Launch the "Petya.A/NotPetya" scanner and delete it. Remember to back up your files and save it on a secure device to avoid data loss.

Meanwhile, security experts are working to develop tools to block the spread of the virus.

Petya Recommendations from Open Data Security

So that you do not become the next victim of Petya, we have a series of recommendations designed for Windows users:

• Back up your files and store them somewhere safe, preferably locally.
• Make sure you have the latest Microsoft Security Patch installed on your PC.
• Confirm that you have the latest version of a reliable antivirus.
• Do not click on attachments of dubious origin.
• If you receive an email asking you to click on a suspicious link, delete it immediately.

If your PC is infected by Petya: DO NOT MAKE ANY BITCOIN PAYMENT TO THE EMAIL PROVIDED BY CYBER CRIMINALS.

According to some sources, the hackers' email address has been disabled, so they will no longer be able to receive any email or receipt of ransom payments. Perhaps for this reason, the same sources suggest that the Victims who have already paid the ransom have not yet gained access to their teams.

If you need help right now, or are looking for an anti-ransomware tool, as well as a way to ensure that your company's activity is not compromised, contact Open Data Security now, and we will be happy to help you protect your business.

Through our Twitter account We will continue to echo the information that comes out about the Petya ransomware, do not hesitate to follow us!