WannaCry Déjà Vu: Petya Ransomware Outbreak Wreaking Havoc Across the Globe

[manhtom]

There are early signs of a new ransomware outbreak, currently affecting a large number of countries across the globe, such as the UK, Ukraine, India, the Netherlands, Spain, Denmark, and others.

At the time of writing, the ransomware outbreak is smaller than WannaCry, but the volume is "considerable," according to Costin Raiu, Kaspersky Labs researcher, and MalwareHunter, an independent security researcher.

The main culprit behind this attack is a new version of Petya, a ransomware that encrypts MFT (Master File Tree) tables for NTFS partitions and overwrites the MBR (Master Boot Record) with a custom bootloader that shows a ransom note and prevents victims from booting their computer.

Because of this, Petya is more dangerous and intrusive compared to other strains because it reboots systems and prevents them from working altogether.

 

[BoraMurdar]

Prepare for impact!
Kidding, just backup important data

Spoiler

 

[AtlBo]

Secure Folders is a good option for protecting files and folders. Have it on a PC, and I use it to restrict write privileges to the backup program on the PC to backup drives connected to the PC. Still experimenting. For now that's my fallback for that PC, but if anyone knows a way to use SF to protect the mbr, that would be very nice

 

[brambedkar59]

Another reminder that Ransomware isn't going anywhere anytime soon. Just like no matter what, all of the 100% PC users are not going to make backups.

 

[Winter Soldier]

The use of Petya is quite atypical for a cyber-criminal action on this scale.
It may be used as destructive tool for its feature to encrypt the hard disk of the computer, which then becomes unusable and so causing disorder action, but it is a ransomware and not, strictly speaking, a cyber-weapon.
It is perfect to cover an attack with geopolitics purpose...for example.

 

[Weebarra]

I have just seen this on the news and whilst i should be shocked that it has happened so soon after the last large scale ransom attack but i'm not for some reason.
Thankfully (due to members on here) i do back up frequently and am trialing Kaspersky a the moment so i'm hoping that (along with some common sense) keeps me safe as i am on Windows 7 which was hit the largest the last time.

 

[ispx]

am r.o.t.f.l.m.a.o. at @BoraMurdar 's post

on a more serious note like the mod has stated, brace yourself people & get used to it.

i expect a whole lot more of this happening after the data leak at microsoft.

 

[Daljeet]

A major cyber-attack has struck large companies across Europe, with Ukraine’s government, banks, state electricity grid, telephone companies and even metro particularly badly affected.



The attack has caused serious disruption at companies including advertising multinational WPP, France’s Saint-Gobain, Russian steel, mining and oil firms Evraz and Rosneft, and the Danish shipping giant AP Moller-Maersk.

• The ransomware might display the following message on an infected PC:
  
  Repairing file system on C:
  
  The type of the file system is NTFS.
  One of your disks contains errors and needs to be repaired. This process may take several hours to complete. It is strongly recommended to let it complete.
  
  WARNING: DO NOT TURN OFF YOUR PC! IF YOU ABORT THIS PROCESS, YOU COULD DESTROY ALL OF YOUR DATA! PLEASE ENSURE THAT YOUR POWER CABLE IS PLUGGED IN!
  
  CHKDSK is repairing sector xxxxx of xxxxxxxx (x%)
  
  
• After encryption, impacted systems might prompt the user to reboot. After reboot, a ransom screen similar to the following is displayed:
• 

Extensions currently known as being affected are: .3ds, .7z, .accdb, .ai, .asp, .aspx, .avhd, .back, .bak, .c, .cfg, .conf, .cpp, .cs, .ctl, .dbf, .disk, .djvu, .doc, .docx, .dwg, .eml, .fdb, .gz, .h, .hdd, .kdbx, .mail, .mdb, .msg, .nrg, .ora, .ost, .ova, .ovf, .pdf, .php, .pmf, .ppt, .pptx, .pst, .pvi, .py, .pyc, .rar, .rtf, .sln, .sql, .tar, .vbox, .vbs, .vcb, .vdi, .vfd, .vmc, .vmdk, .vmsd, .vmx, .vsdx, .vsv, .work, .xls, .xlsx, .xvd, .zip



We have confirmed with the samples that SMB is being used as a propogation method, and are aware of reports that RDP may also be used but have yet to confirm this.



After encryption, impacted systems may show a ransom screen and suggest a system reboot after which the system will not be accessible.

 

[Parsh]

Folks, it's apparently Not Petya!
-----------------------------------------------------------------------------

 

[Winter Soldier]

Folks, it's apparently Not Petya!
-----------------------------------------------------------------------------
View attachment 157925

Thanks @Parsh, this would confirm what I said above.

 

[Korea]

ESET is tracking an outbreak of the Win32/Diskcoder.C Trojan probably related to the Petya family. ESET LiveGrid has blocked the threat since ~13:30 CEST 6/27.

https://forum.eset.com/topic/12396-petya-malware-detected-as-win32diskcoderc-spreading-rapidly/
New ransomware attack hits Ukraine ... may be global in scope

 

[Daljeet]

NotPetya has some extra powers that security experts say make it deadlier than WannaCry.This dangerous combination may be the reason why this outbreak has spread globally and rapidly, even after the previous outbreaks have generated media headlines and hopefully most vulnerabilities have been patched," said ESET researcher Robert Lipovsky. "It only takes one unpatched computer to get inside the network, and the malware can get administrator rights and spread to other computers.

 

[brambedkar59]

The ransomware might display the following message on an infected PC:

Repairing file system on C:

• 
  The type of the file system is NTFS.
  One of your disks contains errors and needs to be repaired. This process may take several hours to complete. It is strongly recommended to let it complete.
  
  WARNING: DO NOT TURN OFF YOUR PC! IF YOU ABORT THIS PROCESS, YOU COULD DESTROY ALL OF YOUR DATA! PLEASE ENSURE THAT YOUR POWER CABLE IS PLUGGED IN!
  
  CHKDSK is repairing sector xxxxx of xxxxxxxx (x%)
  
  
• After encryption, impacted systems might prompt the user to reboot. After reboot, a ransom screen similar to the following is displayed:
• 

Sneaky-breeky. Malware authors are getting pretty good at disguising the malware as windows apps/tools.

Extensions currently known as being affected are: .3ds, .7z, .accdb, .ai, .asp, .aspx, .avhd, .back, .bak, .c, .cfg, .conf, .cpp, .cs, .ctl, .dbf, .disk, .djvu, .doc, .docx, .dwg, .eml, .fdb, .gz, .h, .hdd, .kdbx, .mail, .mdb, .msg, .nrg, .ora, .ost, .ova, .ovf, .pdf, .php, .pmf, .ppt, .pptx, .pst, .pvi, .py, .pyc, .rar, .rtf, .sln, .sql, .tar, .vbox, .vbs, .vcb, .vdi, .vfd, .vmc, .vmdk, .vmsd, .vmx, .vsdx, .vsv, .work, .xls, .xlsx, .xvd, .zip.

So essentially an advanced user can save all his files from being encrypted by the ransomware by just changing the extension. Although not practical at all

 

[ispx]

in the articles that i have read & in the news on tv about this attack i did not really see any mention of a specific os being targeted.

unless i missed it while reading / watching so please enlighten me.

if i am not wrong wannacry jacked up xp & 7 mostly, is it the same this time? or is this new attack crippling 10 too?

 

[Malware Person]

users are advised to use your brain while surfing the web and get it over with.

 

[ispx]

Just like no matter what, all of the 100% PC users are not going to make backups.

you would be surprised at the number of windows users i know who seriously think an anti-virus is a waste of money.

 

[In2an3_PpG]

in the articles that i have read & in the news on tv about this attack i did not really see any mention of a specific os being targeted.

unless i missed it while reading / watching so please enlighten me.

if i am not wrong wannacry jacked up xp & 7 mostly, is it the same this time? or is this new attack crippling 10 too?

Well if its similiar to WannaCry in that its using Eternalblue and DoublePulsar to exploit SMB then any device that has an vulnerable public facing SMB port open could be toast. As far as i know.

 

[In2an3_PpG]

users are advised to use your brain while surfing the web and get it over with.

As i agree that commonsense is a good practice while surfing the web. It will not help you in this case as this attack does not occurr through the browser.

 

[brambedkar59]

you would be surprised at the number of Windows users i know who seriously think an anti-virus is a waste of money.

IMO, Backup+Free AV >>> Paid AV+no backup. So....

 

[509322]

Prepare for impact!
Kidding, just backup important data

Spoiler

An all-time classic post.