Forest Global Training Partners

Cyber Risks · Krebs on Security

‘Petya’ Ransomware Outbreak Goes Global

Summary: A ransomware strain dubbed Petya spread worldwide in June 2017 using Eternal Blue, the same Microsoft Windows vulnerability patched in March 2017 (MS17-010) that WannaCry exploited. Ukraine's government, banks and largest power companies reported infections, Maersk said its IT systems were down across multiple sites, Rosneft reported a "powerful hacker attack," and DLA Piper experienced issues with its U.S. systems.

Key Takeaway: Symantec confirmed Petya uses Eternal Blue, a tool believed developed by the NSA and leaked online in April 2017 by the Shadow Brokers, and many businesses that put off the March patch were already hit by WannaCry in May. Researcher Nicholas Weaver said Petya's ransom note uses the same Bitcoin address for every victim and an email contact instead of Tor, leading him to assess with moderate confidence it was a deliberate destructive attack or a test disguised as ransomware.

Read the original at Krebs on Security ↗

Topics
Malware
Related