New Ransomware Variant "Nyetya" Compromises Systems Worldwide
Summary: Cisco Talos identified a new malware variant it calls Nyetya, distinct from Petya and also referred to as Petrwrap and GoldenEye, which uses EternalBlue, EternalRomance, WMI, and PsExec to move laterally inside infected networks. Talos assesses with high confidence that the actor's intent was destructive rather than economically motivated, and notes the posteo.de mailbox used for payment verification and decryption key sharing has been shut down.
What you should know: Paying the ransom cannot work here: the mailbox for verifying payments and distributing decryption keys is gone, and the malware has no command-and-control channel for remote unlocking, so any payment is useless. Talos also found Nyetya overwrites the boot sector without saving a copy, or wipes the first ten sectors of the disk, and specifically wipes those sectors on systems running Kaspersky Anti-virus (avp.exe).
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026