Petya virus – is it ransomware and which companies have been hit by the global cyber attack?

A CYBER attack dubbed “Petya” has hit computer servers around the world crippling companies in Britain, Europe and Chernobyl.

Here’s what you need to know behind the second major cyber attack – which is being likened to WannaCry – in two months.



GETTY IMAGES


3 Companies have been crippled by an attack dubbed ‘Petya’


What is the Petya?


Petya is a malicious software which targeted victims in the UK, Europe and the US with computer screens warning that their files and systems would be destroyed if they did not send the equivalent of about £300 in bitcoin.


Travis Farral, director of security strategy at tech firm Anomali, said: “This is a global attack. Just like WannaCry, organisations are locked out of their networks and a fee demanded to decrypt files.


“Bitcoin payments are currently already at $2,000+ already. But it’s essential that victims understand that payment may not actually allow them to access their data, and may just fund hackers to commit further crimes.”


The cyber-assault is particularly severe because it is understood that just 10 out of 61 antivirus programs are capable of tackling it.


The source of the attacks was not immediately clear.




3 A view of a computer that has been infected by the Petya ransomware

What is ransomware?


Ransomware is a virus which takes over a device (or computer) and freezes its files.


Hackers use it to hold the recipient to ransom, asking for money in return for access to their documents.


The ransomware can be spread by accidentally clicking a bad link.


It’s often shared in an email, or in some cases hackers could booby-trap a website they know employees will visit, like a government portal.


Security experts always advise against paying a ransom, as hackers will often destroy the files anyway.


Criminal gangs will send out thousands of these emails, called phishing scams, in the hope that just a few will click on the link.
Is the Petya virus a ransomware?


The virus that is sweeping the globe is believed to be a “wiper” designed to cause mayhem and is not actually ransomware.


Cyber experts say Petya is hell-bent on destroying files permanently.


Russian cybersecurity expert at Kaspersky Labs wrote in a blogpost: “After an analysis of the encryption routine of the malware used in the Petya attacks, we have thought that the threat actor cannot decrypt victims’ disk, even if a payment was made.


“This supports the theory that this malware campaign was not designed as a ransomware attack for financial gain.


“Instead, it appears it was designed as a wiper pretending to be ransomware.


“What does it mean? Well, first of all, this is the worst case news for the victims – even if they pay the ransom they will not get their data back.


“Secondly, this reinforces the theory that the main goal of the ExPetr attack was not financially motivated, but destructive.”
Which companies have been hit by the Petya ransomware attack?




3 Where the attacks are known to have hit so far


British advertising giant WPP and the French industrial group Saint-Gobain all said they came under attack and put protection protocols in place to avoid data loss.


Ukraine was the worst hit, with government ministries, banks, utilities, telecom operators and major companies attacked.


Computers at the Chernobyl nuclear power plant have been infected, although there is not believed to be any risk of radioactive contamination.


Shipping giant A.P. Moller-Maersk, a firm which handles one out of seven containers shipped globally, said its systems were down across “multiple sites and business units due to a cyber attack”.


The crippling virus has forced the Danish company to halt operations at the fully automated Maasvlakte II terminal in Rotterdam.


Mondelez, the owners of Cadbury, were also hit in the devastating attack.


Russian oil giant Rosneft announced that its servers has been hit by a “powerful hacking attack” carried out “against the company’s servers”.


Russian web security firm Group-IB said the Petya ransomware was used in today’s massive attack on oil, telecommunications and financial companies in the former Soviet Union.

Technology Mania : all security reports and analytics about wanacry ransom-ware

wanacry ransom-ware

our products detected and successfully blocked a large number of ransomware attacks around the world. In these attacks, data is encrypted with the extension “.WCRY” added to the filenames.

Our analysis indicates the attack, dubbed “WannaCry”, is initiated through an SMBv2 remote code execution in Microsoft Windows. This exploit (codenamed “EternalBlue”) has been made available on the internet through the Shadowbrokers dump on April 14th, 2017 and patched by Microsoft on March 14.

Unfortunately, it appears that many organizations have not yet installed the patch.

Source: https://support.kaspersky.com/shadowbrokers

A few hours ago, Spain’s Computer Emergency Response Team CCN-CERT, posted an alert on their site about a massive ransomware attack affecting several Spanish organizations. The alert recommends the installation of updates in the Microsoft March 2017 Security Bulletin as a means of stopping the spread of the attack.

The National Health Service (NHS) in the U.K. also issued an alert and confirmed infections at 16 medical institutions. We have confirmed additional infections in several additional countries, including Russia, Ukraine, and India.

It’s important to understand that while unpatched Windows computers exposing their SMB services can be remotely attacked with the “EternalBlue” exploit and infected by the WannaCry ransomware, the lack of existence of this vulnerability doesn’t really prevent the ransomware component from working. Nevertheless, the presence of this vulnerability appears to be the most significant factor that caused the outbreak.

CCN-CERT alert (in Spanish)

Analysis of the attack

Currently, we have recorded more than 45,000 attacks of the WannaCry ransomware in 74 countries around the world, mostly in Russia. It’s important to note that our visibility may be limited and incomplete and the range of targets and victims is likely much, much higher.

Geographical target distribution according to our telemetry for the first few hours of the attack

The malware used in the attacks encrypts the files and also drops and executes a decryptor tool. The request for $600 in Bitcoin is displayed along with the wallet. It’s interesting that the initial request in this sample is for $600 USD, as the first five payments to that wallet is approximately $300 USD. It suggests that the group is increasing the ransom demands.

The tool was designed to address users of multiple countries, with translated messages in different languages.

Language list that the malware supports

Note that the “payment will be raised” after a specific countdown, along with another display raising urgency to pay up, threatening that the user will completely lose their files after the set timeout. Not all ransomware provides this timer countdown.

To make sure that the user doesn’t miss the warning, the tool changes the user’s wallpaper with instructions on how to find the decryptor tool dropped by the malware.

An image used to replace user’s wallpaper

Malware samples contain no reference to any specific culture or codepage other than universal English and Latin codepage CP1252. The files contain version info stolen from random Microsoft Windows 7 system tools:

Properties of malware files used by WannaCry

For convenient bitcoin payments, the malware directs to a page with a QR code at btcfrog, which links to their main bitcoin wallet 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94. Image metadata does not provide any additional info:

One of the Bitcoin wallets used by the attackers: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

One of the attacker wallets received 0.88 BTC during the last hours

Another Bitcoin wallets included in the attackers’ “readme.txt” from the samples are:
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn – 0.32 BTC

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw – 0.16 BTC
1QAc9S5EmycqjzzWDc1yiWzr9jJLC8sLiY

For command and control, the malware extracts and uses Tor service executable with all necessary dependencies to access the Tor network:

A list of dropped files related to Tor service

In terms of targeted files, the ransomware encrypts files with the following extensions:

.der, .pfx, .key, .crt, .csr, .p12, .pem, .odt, .ott, .sxw, .stw, .uot, .3ds, .max, .3dm, .ods, .ots, .sxc, .stc, .dif, .slk, .wb2, .odp, .otp, .sxd, .std, .uop, .odg, .otg, .sxm, .mml, .lay, .lay6, .asc, .sqlite3, .sqlitedb, .sql, .accdb, .mdb, .dbf, .odb, .frm, .myd, .myi, .ibd, .mdf, .ldf, .sln, .suo, .cpp, .pas, .asm, .cmd, .bat, .ps1, .vbs, .dip, .dch, .sch, .brd, .jsp, .php, .asp, .java, .jar, .class, .mp3, .wav, .swf, .fla, .wmv, .mpg, .vob, .mpeg, .asf, .avi, .mov, .mp4, .3gp, .mkv, .3g2, .flv, .wma, .mid, .m3u, .m4u, .djvu, .svg, .psd, .nef, .tiff, .tif, .cgm, .raw, .gif, .png, .bmp, .jpg, .jpeg, .vcd, .iso, .backup, .zip, .rar, .tgz, .tar, .bak, .tbk, .bz2, .PAQ, .ARC, .aes, .gpg, .vmx, .vmdk, .vdi, .sldm, .sldx, .sti, .sxi, .602, .hwp, .snt, .onetoc2, .dwg, .pdf, .wk1, .wks, .123, .rtf, .csv, .txt, .vsdx, .vsd, .edb, .eml, .msg, .ost, .pst, .potm, .potx, .ppam, .ppsx, .ppsm, .pps, .pot, .pptm, .pptx, .ppt, .xltm, .xltx, .xlc, .xlm, .xlt, .xlw, .xlsb, .xlsm, .xlsx, .xls, .dotx, .dotm, .dot, .docm, .docb, .docx, .doc

The file extensions that the malware is targeting contain certain clusters of formats including:

1. Commonly used office file extensions (.ppt, .doc, .docx, .xlsx, .sxi).
2. Less common and nation-specific office formats (.sxw, .odt, .hwp).
3. Archives, media files (.zip, .rar, .tar, .bz2, .mp4, .mkv)
4. Emails and email databases (.eml, .msg, .ost, .pst, .edb).
5. Database files (.sql, .accdb, .mdb, .dbf, .odb, .myd).
6. Developers’ sourcecode and project files (.php, .java, .cpp, .pas, .asm).
7. Encryption keys and certificates (.key, .pfx, .pem, .p12, .csr, .gpg, .aes).
8. Graphic designers, artists and photographers files (.vsd, .odg, .raw, .nef, .svg, .psd).
9. Virtual machine files (.vmx, .vmdk, .vdi).

The WannaCry dropper drops multiple “user manuals” on different languages:

Bulgarian, Chinese (simplified), Chinese (traditional), Croatian, Czech, Danish, Dutch, English, Filipino, Finnish, French, German, Greek, Indonesian, Italian, Japanese, Korean, Latvian, Norwegian, Polish, Portuguese, Romanian, Russian, Slovak, Spanish, Swedish, Turkish, Vietnamese

The example of a “user manual” in English:

What Happened to My Computer?
Your important files are encrypted.
Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to
recover your files, but do not waste your time. Nobody can recover your files without our decryption service.

Can I Recover My Files?
Sure. We guarantee that you can recover all your files safely and easily. But you have not so enough time.
You can decrypt some of your files for free. Try now by clicking .
But if you want to decrypt all your files, you need to pay.
You only have 3 days to submit the payment. After that the price will be doubled.
Also, if you don't pay in 7 days, you won't be able to recover your files forever.
We will have free events for users who are so poor that they couldn't pay in 6 months.

How Do I Pay?
Payment is accepted in Bitcoin only. For more information, click .
Please check the current price of Bitcoin and buy some bitcoins. For more information, click .
And send the correct amount to the address specified in this window.
After your payment, click . Best time to check: 9:00am - 11:00am GMT from Monday to Friday.
Once the payment is checked, you can start decrypting your files immediately.

Contact
If you need our assistance, send a message by clicking .

We strongly recommend you to not remove this software, and disable your anti-virus for a while, until you pay and the payment gets processed. If your anti-virus gets
updated and removes this software automatically, it will not be able to recover your files even if you pay!

It also drops batch and VBS script files, and a “readme” (contents are provided in the appendix).

Just in case the user closed out the bright red dialog box, or doesn’t understand it, the attackers drop a text file to disk with further instruction. An example of their “readme” dropped to disk as “@Please_Read_Me@.txt” to many directories on the victim host. Note that the English written here is done well, with the exception of “How can I trust?”. To date, only two transactions appear to have been made with this 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn bitcoin address for almost $300:

Q: What's wrong with my files?

A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted.
If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!
Let's start decrypting!

Q: What do I do?

A: First, you need to pay service fees for the decryption.
Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software.
Run and follow the instructions! (You may need to disable your antivirus for a while.)

Q: How can I trust?

A: Don't worry about decryption.
We will decrypt your files surely because nobody will trust us if we cheat users.

* If you need our assistance, send a message by clicking on the decryptor window.

Once started it immediately spawns several processes to change file permissions and communicate with tor hidden c2 servers:

• attrib +h .
• icacls . /grant Everyone:F /T /C /Q
• C:\Users\xxx\AppData\Local\Temp\taskdl.exe
• @WanaDecryptor@.exe fi
• 300921484251324.bat
• C:\Users\xxx\AppData\Local\Temp\taskdl.exe
• C:\Users\xxx\AppData\Local\Temp\taskdl.exe

The malware checks the mutexes “Global\MsWinZonesCacheCounterMutexA” and “Global\MsWinZonesCacheCounterMutexA0” (Update: Thanks Didier Stevens for the correction on the extra mutex name!) to determine if a system is already infected. It also runs the command:

cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

This results in an UAC popup that user may notice.

UAC popup to disable Volume Shadow Service (System Restore)

The malware use TOR hidden services for command and control. The list of .onion domains inside is as following:

• gx7ekbenv2riucmf.onion
• 57g7spgrzlojinas.onion
• Xxlvbrloxvriy2c5.onion
• 76jdd2ir2embyv47.onion
• cwwnhwhlz52maqm7.onion
• sqjolphimrr7jqw6.onion

Mitigation and detection information

Quite essential in stopping these attacks is the Kaspersky System Watcher component. The System Watcher component has the ability to rollback the changes done by ransomware in the event that a malicious sample managed to bypass other defenses. This is extremely useful in case a ransomware sample slips past defenses and attempts to encrypt the data on the disk.

System Watcher blocking the WannaCry attacks

Mitigation recommendations:

1. Make sure that all hosts are running and have enabled endpoint security solutions.
2. Install the official patch (MS17-010) from Microsoft, which closes the affected SMB Server vulnerability used in this attack.
3. Ensure that Kaspersky Lab products have the System Watcher component enabled.
4. Scan all systems. After detecting the malware attack as MEM:Trojan.Win64.EquationDrug.gen, reboot the system. Once again, make sure MS17-010 patches are installed.

Samples observed in attacks so far:

4fef5e34143e646dbf9907c4374276f5
5bef35496fcbdbe841c82f4d1ab8b7c2
775a0631fb8229b2aa3d7621427085ad
7bf2b57f2a205768755c07f238fb32cc
7f7ccaa16fb15eb1c7399d422f8363e8
8495400f199ac77853c53b5a3f278f3e
84c82835a5d21bbcf75a61706d8ab549
86721e64ffbd69aa6944b9672bcabb6d
8dd63adb68ef053e044a5a2f46e0d2cd
b0ad5902366f860f85b892867e5b1e87
d6114ba5f10ad67a4131ab72531f02da
db349b97c37d22f5ea1d1841e3c89eb4
e372d07207b4da75b3434584cd9f3450
f529f4556a5126bba499c26d67892240

Kaspersky Lab detection names:

Trojan-Ransom.Win32.Gen.djd
Trojan-Ransom.Win32.Scatter.tr
Trojan-Ransom.Win32.Wanna.b
Trojan-Ransom.Win32.Wanna.c
Trojan-Ransom.Win32.Wanna.d
Trojan-Ransom.Win32.Wanna.f
Trojan-Ransom.Win32.Zapchast.i
PDM:Trojan.Win32.Generic

Kaspersky Lab experts are currently working on the possibility of creating a decryption tool to help victims. We will provide an update when a tool is available.

Appendix

Batch file

@echo off
echo SET ow = WScript.CreateObject("WScript.Shell")> m.vbs
echo SET om = ow.CreateShortcut("C:\Users\ADMINI~1\AppData\Local\Temp\@WanaDecryptor@.exe.lnk")>> m.vbs

echo om.TargetPath = “C:\Users\ADMINI~1\AppData\Local\Temp\@WanaDecryptor@.exe”>> m.vbs

echo om.Save>> m.vbs
cscript.exe //nologo m.vbs
del m.vbs
del /a %0

m.vbs

SET ow = WScript.CreateObject("WScript.Shell")
SET om = ow.CreateShortcut("C:\Users\ADMINI~1\AppData\Local\Temp\@WanaDecryptor@.exe.lnk")
om.TargetPath = "C:\Users\ADMINI~1\AppData\Local\Temp\@WanaDecryptor@.exe"
om.Save

article from:Securlist.com

*Raed also this all security reports and analytics about wanacry ransom-ware

*sophos* 

 Wanna Decrypter 2.0 ransomware attack: what you need to know

*Microsoft reply*

 Wanna Cry Ransomware

*Fortinet* 

Critical Update: WannaCry Ransomware

No Tears for WannaCry: Five Steps Every CISO Should Consider for Protecting Your Organization from Ransomware

Protecting Your Organization from the WCry Ransomware

*Symantec*

What you need to know about the WannaCry Ransomware

*Kaspersky*

WannaCry: Are you safe?

*Mcafee*

Protecting against Ransom-WannaCry

*Krebsonsecurity*

 Microsoft Issues WanaCrypt Patch for Windows 8, XP

*Zerohedge*

 Ransomware Attack Strikes Over 57,000 Users Worldwide, Using NSA-Leaked Tools

One-third of ransomware incidents in APAC from India in Q3 2016: Kaspersky

By Naina Khedekar /  07 Oct 2016 , 17:56

In June earlier this year, Vitaly Kamluk, Kaspersky Lab’s Director of Global Research and Analysis Team in APAC, had said how India stands among the top 5 countries in the world attacked by ransomware. Now, he tells Tech2 that one-third of the ransomware incidents in APAC  in Q3 2016 were in India. The India trend showed a drop in Q2 2016 compared to Q1 by 50 percent, but quickly followed by a 100 percent increase in Q3 2016. It went down during the summer and could be probably related to Indian holiday time as it started picking soon by the end of summer.

Talking about future threats, Vitaly Kamluk says security of cloud providers, IoT, automotive is important #KasperskyLab pic.twitter.com/dR8j6uCOpY

— Tech2 (@tech2eets) October 7, 2016

Kamluk said that India requires more awareness to deal by making people prepare for such attacks so that they don’t lose money. And, it will also require some initiatives from the government. Countries like Russia and Singapore have hoarding education general public around cyber crimes and precaution. In some

Those over 55 aren't adequately protecting themselves online, survey finds

By Shawn Knight on October 5, 2016, 4:45 PM



While it’s generally accepted that wisdom comes with age, that’s certainly not always the case. Research from Kaspersky Lab and market researcher B2B International has shown that those of the older generation are increasingly finding their way to the Internet albeit with a general lack of awareness that could put them at risk.

In a survey of more than 12,500 Internet users as part of a report entitled: “Older and Wiser? A look at the Threats Faced by Over-55s Online,” the firms found that despite the fact that those 55 and older are more likely to install security software on their computers, they are less likely to protect their mobile devices or modify online behavior in the name of safety.

For example, the older generation uses high privacy settings on social media and in their web browsers less than other age groups. Furthermore, they’re unlikely to use security-minded functions of mobile devices like “find my phone” or VPNs.

Data from the survey shows that a whopping 86 percent of those 55 and older do not believe they are a target for cyber criminals. Perhaps even more concerning is the fact that four in 10 have put themselves at risk by sharing financial details in the public domain.

Andrei Mochola, head of consumer business at Kaspersky Lab, said that on the one hand, it’s great to see that so many over-55s are using the Internet to shop, bank and stay connected with loved ones. On the other hand, however, it’s clear that this age group is not doing enough to protect themselves properly.

As such, Mochola encourages younger Internet users to help their older relatives and friends better protect themselves from the very real threats posed by cyber criminals. Suggestions for the older generation include being more vigilant online, installing reliable security solutions and using high privacy settings on all devices used to access the net.