Threat Brief: Petya Ransomware
Summary: On June 27, 2017, Unit 42 identified a new Petya ransomware variant spreading through lateral movement techniques including the ETERNALBLUE exploit, the same tool WannaCry used in May 2017, with at least 50 organizations reporting impacts, mostly in Ukraine but also spreading across national borders within global organizations' networks. The malware overwrites the Master Boot Record, displays a fake chkdisk screen while encrypting the NTFS Master File Table, and demands $300 in Bitcoin, though Posteo has shut down the attacker's email address and Unit 42 is unaware of any successful recovery after payment.
What you should know: Unit 42 assesses this malware should be functionally considered a wiper, not ransomware, because its actions make recovery technically infeasible even after payment - and the spread via ETERNALBLUE shows many organizations remained unpatched despite the attention WannaCry received weeks earlier.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2017-0144
- Related
- CVE-2017-0144: Microsoft SMBv1 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Feb 10, 2022Threat Brief: Wana Crypt0r– What We Know Cyber Risks ·