Petya’s Ransomware Attacks Have Failed

As security and software vendors scramble to contain the spread of the Petya ransomware virus, analysts are speculating over what the attackers meant to accomplish by initiating the outbreak.

Ransomware is a money-making virus that encrypts the files on victims’ computers and locks them out until they pay out to obtain the decryption keys. In 2016, cyber-criminals netted about $1 billion from ransomware attacks.

But if the motive behind the Petya ransomware attacks was financial, it was far from a success.  

According to the Twitter bot that tracks bitcoin payments made to the address tied with the Petya ransomware, the attackers have so far netted little more than $10,000 in 46 payments, not a lot for an attack that has made the headlines across the globe and affected thousands of computers.
However, there are many signs indicating that the attackers were more interested in causing targeted mayhem and disruption rather than raising money.

The malware and the attack was carefully designed to cleverly spread across networks, even on computers that were patched up and secure. The developers of Petya avoided many of the mistakes of its recent predecessor, WannaCry, which caused a widespread outbreak last month, by using several techniques to propagate the virus across network and not incorporating any kill switch in the malware.

But as much as Petya’s launch and spreading mechanism are ingenious, the payment mechanism is poorly designed. Ransomware attacks usually assign unique Bitcoin wallets to each infected computer in order to automate the payment and key delivery process. 

But the Petya attackers have used a single Bitcoin address for all payments, which means decryption key delivery has to be done manually, not a wise choice for a virus that is destined to infect tens and possibly hundreds of thousands of computers. It will make also it much easier to trace the attackers as they move their money.

Moreover, the ransomware message that was displayed on infected computers contained an email address that victims had to contact with proof of payment in order to get their decryption keys. Unsurprisingly, the company that hosted the email account shut it down, which means victims are no longer able to recover their files. This is something that the cybercriminals should’ve seen coming.

Given those facts, some experts believe that the real purpose of the attack was to destroy the files on targeted computers. Comae Technologies explained how the malware was in fact a wiper—a virus that aims to destroy and damage—in the guise of ransomware. The virus is also being called NotPetya because it differs from the original Petya ransomware.

One of the noteworthy aspects of the attack was the method it was initiated. The attackers hacked the website of Ukrainian accounting software vendor MEDoc and used it as a beachhead to push virus-infected updates on the computers of its users. MEDoc counts among its customers the Ukrainian government agencies and large businesses. 

While ransomware attacks are usually sporadic and aimed at all kinds of users, the hacking of MEDoc gave the cybercriminals a venue to create a more targeted attack aimed at the economic and political infrastructures of Ukraine.
Also of concern is the fact that the attack came on the eve of the holiday marking Ukraine’s adoption of its first constitution in 1996. That could hardly be a coincidence.

A considerable number of computers outside of Ukraine were also affected by the virus, but that can be considered collateral damage when compared to the sheer number of devices that were hit by the attack in Ukraine.
Many indicators point to Russia, which stands accused of leading an aggressive cyberwarfare against Ukraine. In 2015 and 2016, hackers with alleged links to the Russian government hacked the Ukraine power grid and cut electricity in large swaths of the country. Ukraine’s president reported in December that there had been 6,500 attacks on 36 Ukrainian targets in the previous two months.

However, cyber-crime attribution is very difficult. Cyber-criminals often use tools and techniques that are associated with other hacking groups in order to deceive experts. Experts are reluctant to directly point the finger at the Kremlin, and some described the attack as too blatant and overt to be the work of Russian hacking groups.

We expect more details to emerge, but what is clear is that whoever unleashed the Petya outbreak wasn’t after the money.  

This marks a new chapter in the history of ransomware, a breed of virus that was created for purely financial purposes. With computers and connectivity being incorporated into every device, ransomware is fast turning into a weapon of mass disruption and destruction.

Daily Dot:

You Might Also Read:

Ukraine Police Trace Petya Attack Source:

 


 

 

« Is It Really Possible to Protect Your Health Data?
Germany Gets Tough On Social Media »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

International Computer Science Institute (ICSI)

International Computer Science Institute (ICSI)

ICSI is a leading independent, nonprofit center for research in computer science. Research areas include network security and privacy.

CYSEC Academy

CYSEC Academy

CYSEC Academy offer cyber certifications, cyber assurance and cyber defense training, hands-on learning training modules, public, private and bespoke training courses.

VXRL

VXRL

VXRL is a Hong Kong-based cybersecurity company. We provide consulting services, penetration testing, and corporate training.

Jobsora

Jobsora

Jobsora is an innovative job search platform in the UK and more than 35 other countries around the world. Sectors covered include IT and cybersecurity.

Dale Peterson

Dale Peterson

Dale Peterson, a leading ICS security and control system IT information expert, provides consulting services to assess and improve the security of SCADA and DCS.

Wipe-Global

Wipe-Global

Wipe-Global is specialized in data erasure with an international established service partner network.

Human Security

Human Security

Human (formerly White Ops) Bot Mitigation Platform enables complete protection from sophisticated bot attacks across advertising, marketing and cybersecurity.

Trustify

Trustify

Trustify is a Managed Security Service Provider offering a suite of world-class Cyber Risk Management services.

Quintillion Consulting

Quintillion Consulting

Quintillion Consulting is a strategic risk based consulting firm. We help companies safeguard the core business and IT capabilities that deliver competitive advantage.

Robo Shadow

Robo Shadow

Robo Shadow are trying to bridge the gap between the top tier organisations that can afford everything and everyone else who has to “Make it up as they go along” when it comes to Cyber.

Green Enterprise Solutions

Green Enterprise Solutions

Green Enterprise Solutions are a Namibian company providing Information and Communication Technology (ICT) services to corporate Namibia.

SilverEdge Government Solutions

SilverEdge Government Solutions

SilverEdge is a next generation provider of innovative and proprietary cybersecurity, software, and intelligence solutions for the Defense and Intelligence Communities.

MARS Suite

MARS Suite

MARS Suite is your all-in-one solution for cyber protection & compliance. Cybersecurity and risk management is what we do best. And we’re making it simple and easy.

LevelBlue

LevelBlue

LevelBlue simplify cybersecurity through award-winning managed security services, experienced strategic consulting, threat intelligence and renowned research.

Apexanalytix

Apexanalytix

Apexanalytix is a leading provider of supplier onboarding, risk management and recovery solutions.

Hakai Security

Hakai Security

Hakai is a consulting firm specializing in information security that offers customized services and products to meet the needs and goals of each business.