Security News More Security Firms Confirm NotPetya Shoddy Code Is Making Recovery Impossible

[LASER_oneXM]

...some quotes:

The bandwagon of cyber-security firms claiming that NotPetya was meant for destructive purposes is getting more crowded by the day, with three new additions from Cisco Talos, F-Secure, and Malwarebytes.

This theory was first put forward two days ago by security researchers from Comae Technologies and Kaspersky Lab, who found evidence that the ransomware was bungling its encryption routine and using random data to display the infection ID, respectively.

Both companies highlighted the fact that the NotPetya;s faulty encryption routine was making recovery impossible. Coupled with Ukraine's political context, many experts suggested this was a cyber-weapon designed to destroy as many systems as possible before a Ukrainian national holiday.

Malwarebytes, Cisco, and F-Secure issue reports

In the past two days, other cyber-security companies have confirmed the initial findings. For example, this is the conclusion of a Malwarebytes report published yesterday:

"According to our current knowledge, the malware is intentionally corrupt in a way that the Salsa key was never meant to be restored. Nevertheless, it is still effective in making people pay ransom. [...] If you are a victim of this malware and you are thinking about paying the ransom, we warn you: Don’t do this. It is a scam and you will most probably never get your data back."