The massive WannaCry ransomware is not dead yet and another large scale ransomware attack is making chaos worldwide, infecting and shutting down Machines at scale. A new malware called “Petya Ransomware” or “Petwrap Ransomware” attacked many of the computers at banks, businesses, power supplies, and banks across Russia, Ukraine, Spain, France, UK, India, and Europe and demanding $300 in bitcoins.
According to sources, the malware is spreading rapidly with the help of same Windows SMBv1 vulnerability that the WannaCry ransomware has misused earlier in May 2017 to infect 300,000 computers worldwide in just 72 hours.
What is Petya Ransomware?
Petya is a nasty piece of ransomware and works very differently from any other ransomware malware. Unlike other traditional ransomware, Petya does not encrypt files on a targeted system one by one.
Instead, Petya reboots victims computers and encrypts the hard drive’s master file table (MFT) and renders the master boot record (MBR) inoperable, restricting access to the full system by seizing information about file names, sizes, and location on the physical disk.
Petya ransomware replaces the computer’s MBR with its own malicious code that displays the ransom note and leaves computers unable to boot. According to Security Research firm Kaspersky, Petya could be a variant of Petya.A, Petya.D, or PetrWrap.
How is Petya Ransomware Affecting?
Petya ransomware is spreading over the Microsoft Windows SMB protocol. It uses the Eternalblue exploit tool, which exploits CVE-2017-0144. Just like Wannacry, it is taking advantage of unpatched Windows machines.
“Petya uses the NSA Eternalblue exploit but also spreads in internal networks with WMIC and PSEXEC. That’s why patched systems can get hit.” Mikko Hypponen, Chief Research Officer at F-Secure, has tweeted.
After the system is compromised, the victim is asked to send US $300 in Bitcoin to a specific Bitcoin address and then send an e-mail to them with the victim’s Bitcoin wallet ID to retrieve their individual decryption key.