The latest ransomware outbreak “Petya” is attacking companies across the globe today, the new variants of ransomware are also known as Petwrap / Petya / NotPetya / Nyetya. Quite a number of companies in Europe and Asia are reporting affected.
From the initial analysis, same as last time ransomware outbreak “WannaCry”, this ransom uses multiple techniques to spread, including one which was addressed by a Windows vulnerability MS17-010 via SMBv1. it was also reported that the ransomware used phishing email to spread. once infected, the machine will spread via local network before it encrypts data on local machine.
All versions of Windows Servers and Clients.
Petya ransomware modifies the master boot records (MBR) and encrypts the Master File Table (MFT) of infected Windows computers, making affected machines unusable.
Modify the MBR and encrypt MFT on victims’ computers.
Infected system will reboot after an hour. Since the MBR has been damaged, the system will display a ransom note instead of booting properly.
Data will be unrecoverable due to encrypted by ransomware.
Spread itself to other computers in the local network.
Until now, there is NO effective method to decrypt all the kidnapped files.
Actions Preventing Petya Attack
Enable your firewalls as well as intrusion detection and prevention systems.
Ensure latest signature has been applied on IPS.
Proactively monitor and validate the incoming and outgoing traffic of the network.
Ensure PC has up-to-date Windows updates, especially MS17-010.