Petya Cyber Attack Update

Victims of a major ransomware cyberattack that has spread through the US and Europe can no longer unlock their computers even if they pay the ransom.

The “Petya” ransomware has caused serious disruption at large firms including the advertising giant WPP, French construction materials company Saint-Gobain and Russian steel and oil firms Evraz and Rosneft.

Infected computers display a message demanding a Bitcoin ransom worth $300. Those who pay are asked to send confirmation of payment to an email address. However, that email address has been shut down by the email provider. 
The attack was first reported in Ukraine, where the government, banks, state power utility and Kiev’s airport and metro system were all affected. The radiation monitoring system at Chernobyl was taken offline, forcing employees to use hand-held counters to measure levels at the former nuclear plant’s exclusion zone.

The food giant Mondelez, legal firm DLA Piper, Danish shipping and transport giant AP Moller-Maersk and Heritage Valley Health System, which runs hospitals and care facilities in Pittsburgh, also said their systems had been hit by the malware.
Some technology experts said the attack appeared consistent with an “updated variant” of a virus known as Petya or Petrwrap, a ransomware that locks computer files and forces users to pay a designated sum to regain access. 
But analysts at cyber security firm Kaspersky Labs said they had traced the infections to “a new ransomware that has not been seen before”. The “NotPetya” attack had hit 2,000 users in Russia, Ukraine, Poland, France, Italy, the UK, Germany and the US, Kaspersky said.

Last month’s WannaCry or WannaCrypt ransomware attack affected more than 230,000 computers in over 150 countries, with the UK’s national health service, Spanish phone giant Telefónica and German state railways among those hardest hit.
Symantec cyber security experts said they had confirmed the ransomware in the current attack was using the same exploit – a program that takes advantage of a software vulnerability - as WannaCry.

The exploit, called EternalBlue, was leaked by the Shadow Brokers hacker group in April and is thought to have been developed by the US National Security Agency.

To spread within companies that installed the patch to protect themselves against WannaCry, the Petya ransomware appears to have two other ways of spreading rapidly within an organisation, by targeting the network’s administrator tools. 
It’s not yet clear how computers became infected with the ransomware in the first place, but it doesn’t seem to be through email as happened with WannaCry, said Kalember.

Pictures circulating on social media recently on screens purportedly affected by the attack showed a message stating, “Your files are no longer accessible because they have been encrypted,” and demanding a $300 ransom in the Bitcoin digital currency.

The growing fight against cyber-attacks has seen protection spending surge around the world, with the global cyber security market estimated to be worth some £94bn ($120bn) this year, more than 30 times its size just over a decade ago.
This new attack identified as a variant of Petya (or more accurately, NotPetya) has continued to leverage these and other weaknesses to wreak havoc on computer systems worldwide. The infection has now spread to 60 countries and continues to actively search for more victims.
 
Very much like WannaCry, Petya encrypts the victim’s hard drive and ostensibly demands a ransom of US$300 to be paid in the virtual currency bitcoin. 

However, Petya is proving to be more sophisticated than WannaCry in terms of scope, ability to be neutralised, and apparently, the motivation behind its launch. Notably, this attack spread rapidly within organisations in part by using common IT administrator tools, which are not recognized as malware by traditional security defenses. It may have also leveraged an intrusion at a third-party software vendor. Techniques like these, historically seen in targeted intrusions, are now moving into the mainstream. 
 
Additionally, not only is there is no effective “kill switch” for Petya, the potential to recover data by paying the ransom has been compromised as well. The low dollar amount of the initial ransom combined with the cyber criminal’s current inability to be contacted has fueled speculation over the actual purpose of the attack. Regardless of whether Petya was launched for financial gain, or for political reasons as yet obscure, the end result is that unless an independent “cure” can be found, encrypted data can only be retrieved from a backup copy.
 
Security experts at Kroll suggest the following actions:

  •  Obsolete versions of Microsoft Windows continue to be particularly vulnerable. As we have seen with Petya, lightning can strike twice … or even three or four times. Don’t tempt fate. Unless you have a very specific reason for not doing so, take immediate steps today to move to updated and supported operating systems. If you cannot eliminate outdated, unpatched systems, consider segmenting your network to reduce the attack surface.
  •  Technically, an interesting development is that Petya propagated within organizations using two common Windows administrative tools, Windows Management Instrumentation Command-line (WMIC) and PsExec. While the use of these and other “non-malicious” tools by intruders to quietly move within networks is not new, their use in such a widespread and automated attack is novel. This knowledge underscores the value of implementing modern threat detection and response solutions, and leveraging trained staff or trusted external partners to more rapidly identify and contain this type of attack.
  • Organisations should recognise the very real risk posed by third parties, such as vendors, service providers, etc. At a minimum, review all your vendor risk management processes and institute controls that mitigate potential vulnerabilities. 
  • We cannot emphasise enough the need for backup and recovery plans that are designed with your specific business continuity needs in mind. Ensure that critical data and programs are backed up in a way that will enable recovery in the face of many types of cyber-attacks. 
  •  Finally, consider acquiring cyber insurance policies to mitigate potential losses.

Please Contact Cyber Security Intelligence for more information and a recommended Cyber Insurance Policy for your organisation.

Guardian:

You Might Also Read:

Petya Cyber Attack Hits EU & US:

Petya: The Latest  Global Ransomware Incident:

 

« How A Nation Became Russia's Cyberwar Experiment
Urgent: Investment In NHS Cybersecurity »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Voyager Networks

Voyager Networks

Voyager Networks is an IT solutions business with a focus on Enterprise Networks, Security and Collaborative Communications.

RiskIQ

RiskIQ

RiskIQ is the leader in digital threat management, providing the most comprehensive discovery, intelligence, and mitigation of threats associated with an organization’s digital presence.

Thinkst Applied Research

Thinkst Applied Research

Thinkst is an Applied Research company with a deep focus on information security.

Plurilock Security Solutions

Plurilock Security Solutions

Plurilock is a real-time cybersecurity solution that uses artificial intelligence to identify, prevent, and eliminate insider threats.

CERT Tonga

CERT Tonga

CERT Tonga is the national Computer Emergency Response Team for Tonga.

Cylus

Cylus

Cylus, a global leader in rail cybersecurity, helps rail and metro companies avoid safety incidents and service disruptions caused by cyber-attacks.

Hellenic Accreditation System (ESYD)

Hellenic Accreditation System (ESYD)

ESYD is the national accreditation body for Greece. The directory of members provides details of organisations offering certification services for ISO 27001.

WiSecure Technologies

WiSecure Technologies

WiSecure Technologies aims to develop cryptographic products meeting requirements in the new economic era.

US Venture Partners (USVP)

US Venture Partners (USVP)

USVP is a leading Silicon Valley venture capital firm focusing on early-stage start-ups that transform cybersecurity, enterprise software, consumer mobile and e-commerce, and healthcare.

German Israeli Partnership Accelerator (GIPA)

German Israeli Partnership Accelerator (GIPA)

GIPA is based on two pillars: it is an incubator aimed at young academics and a program to transfer cybersecurity expertise to corporate partners.

BLUECYFORCE

BLUECYFORCE

BLUECYFORCE is the leading professional training and cyber defense training organization in France.

SecureThings

SecureThings

SecureThings focus is to provide guidance and technology to secure connected vehicles in order to build end-to-end security for the automotive industry.

Axellio

Axellio

Axellio provides economic, end-to-end cyber security solutions designed for your team, environment, and security objectives, providing packet level visibility across your network.

Darkscope

Darkscope

Darkscope is an award-winning personalised cyber intelligence service provider. Our cutting-edge AI and Deep Artificial Neural Networks lead the world of cyber intelligence solutions.

Corix Partners

Corix Partners

Corix Partners is a Boutique Management Consultancy Firm focused on assisting CIOs and other C-level executives in resolving Cyber Security Strategy, Organisation and Governance challenges.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.