Petya (malware family)

Source: Wikipedia, the free encyclopedia.
(Redirected from
NotPetya
)

skull and crossbones is displayed as part of the payload on the original version of Petya.[1]
ClassificationTrojan horse
TypeMalware
SubtypeCryptovirus
Operating system(s) affectedWindows

Petya is a family of encrypting malware that was first discovered in 2016.[2] The malware targets Microsoft Windows–based systems, infecting the master boot record to execute a payload that encrypts a hard drive's file system table and prevents Windows from booting. It subsequently demands that the user make a payment in Bitcoin in order to regain access to the system.

Variants of Petya were first seen in March 2016, which propagated via infected

GRU Russian military intelligence organization, by security researchers, Google, and several governments.[2][3][4][5]

History

Petya was discovered in March 2016;

CryptoWall, it contained notable differences in operation that caused it to be "immediately flagged as the next step in ransomware evolution".[1] Another variant of Petya discovered in May 2016 contained a secondary payload used if the malware cannot achieve administrator-level access.[6]

The name "Petya" is a reference to the 1995

Heise suggested may have belonged to the author of the malware, named "Janus Cybercrime Solutions" after Alec Trevelyan's crime group in GoldenEye, had an avatar with an image of GoldenEye character Boris Grishenko, a Russian hacker and antagonist in the film played by Scottish actor Alan Cumming.[7]

On 30 August 2018, a regional court in Nikopol in the Dnipropetrovsk Oblast of Ukraine convicted an unnamed Ukrainian citizen to one year in prison after pleading guilty to having spread a version of Petya online.[8][9][10]

2017 cyberattack

NotPetya's ransom note displayed on a compromised system

On 27 June 2017, a major global cyberattack began (Ukrainian companies were among the first to state they were being attacked[11]), utilizing a new variant of Petya. On that day, Kaspersky Lab reported infections in France, Germany, Italy, Poland, the United Kingdom, and the United States, but that the majority of infections targeted Russia and Ukraine, where more than 80 companies were initially attacked, including the National Bank of Ukraine.[11][12] ESET estimated on 28 June 2017 that 80% of all infections were in Ukraine, with Germany second hardest hit with about 9%.[13] Russian president Vladimir Putin's press secretary, Dmitry Peskov, stated that the attack had caused no serious damage in Russia.[13] Experts believed this was a politically-motivated attack against Ukraine, since it occurred on the eve of the Ukrainian holiday Constitution Day.[14][15]

Oleksandr Kardakov, the founder of the Oktava Cyber Protection company, emphasizes that the Petya virus stopped a third of Ukraine's economy for three days, resulting in losses of more than 400 million dollars[16].

Kaspersky dubbed this variant "NotPetya", as it has major differences in its operations in comparison to earlier variants.

power grid, bus stations, gas stations, the airport, and banks".[11][17]

It was believed that the software update mechanism of M.E.Doc [uk]—a Ukrainian tax preparation program that, according to F-Secure analyst Mikko Hyppönen, "appears to be de facto" among companies doing business in the country—had been compromised to spread the malware.[13][18][19] Analysis by ESET found that a backdoor had been present in the update system for at least six weeks prior to the attack, describing it as a "thoroughly well-planned and well-executed operation".[20] The developers of M.E.Doc denied that they were entirely responsible for the cyberattack, stating that they too were victims.[18][21][22][23]

On 4 July 2017, Ukraine's cybercrime unit seized the company's servers after detecting "new activity" that it believed would result in "uncontrolled proliferation" of malware. Ukraine police advised M.E.Doc users to stop using the software, as it presumed that the backdoor was still present.[20][24] Analysis of the seized servers showed that software updates had not been applied since 2013, there was evidence of Russian presence, and an employee's account on the servers had been compromised; the head of the units warned that M.E.Doc could be found criminally responsible for enabling the attack because of its negligence in maintaining the security of their servers.[20][23][25] IT-businessman, chairman of the supervisory board of the Oktava Capital company Oleksandr Kardakov proposed to create civil cyber defense in UkraineOleksandr Kardakov, the founder of the Oktava Cyber Protection company, emphasizes that the Petya virus stopped a third of Ukraine's economy for three days, resulting in losses of more than 400 million dollars[26].

Operation

Petya's payload infects the computer's

chkdsk, Windows' file system scanner, suggesting that the hard drive's sectors are being repaired.[1]

The original payload required the user to grant it administrative privileges; one variant of Petya was bundled with a second payload, Mischa, which activated if Petya failed to install. Mischa is a more conventional ransomware payload that encrypts user documents, as well as executable files, and does not require administrative privileges to execute.[6] The earlier versions of Petya disguised their payload as a PDF file, attached to an e-mail.[6] United States Computer Emergency Response Team (US-CERT) and National Cybersecurity and Communications Integration Center (NCCIC) released Malware Initial Findings Report (MIFR) about Petya on 30 June 2017.[29]

The "NotPetya" variant used in the 2017 attack uses

to spread to other computers on the same network, and uses those passwords in conjunction with PSExec to run code on other local computers.[32][33][34] Additionally, although it still purports to be ransomware, the encryption routine was modified so that the malware could not technically revert its changes.[35] This characteristic, along with other unusual signs in comparison to WannaCry (including the relatively low unlock fee of US$300, and using a single, fixed Bitcoin wallet to collect ransom payments rather than generating a unique ID for each specific infection for tracking purposes),[36] prompted researchers to speculate that this attack was not intended to be a profit-generating venture, but to damage devices quickly, and ride off the media attention WannaCry received by claiming to be ransomware.[37][38]

Mitigation

It was found that it may be possible to stop the encryption process if an infected computer is immediately shut down when the fictitious chkdsk screen appears,

terms of use. As a result, infected users could not actually send the required payment confirmation to the perpetrator.[36][44] Additionally, if the computer's filesystem was FAT based, the MFT encryption sequence was skipped, and only the ransomware's message was displayed, allowing data to be recovered trivially.[45]

Microsoft had already released patches for supported versions of Windows in March 2017 to address the EternalBlue vulnerability. This was followed by patches for unsupported versions of Windows (such as Windows XP) in May 2017, in the direct wake of WannaCry.[46][47] Wired believed that "based on the extent of damage Petya has caused so far, though, it appears that many companies have put off patching, despite the clear and potentially devastating threat of a similar ransomware spread."[48] Some enterprises may consider it too disruptive to install updates on certain systems, either due to possible downtime or compatibility concerns, which can be problematic in some environments.[46]

Impact

In a report published by Wired, a White House assessment pegged the total damages brought about by NotPetya to more than $10 billion. This assessment was repeated by former Homeland Security advisor Tom Bossert, who at the time of the attack was the most senior cybersecurity focused official in the US government.[49]

During the attack initiated on 27 June 2017, the radiation monitoring system at Ukraine's Chernobyl Nuclear Power Plant went offline.[50] Several Ukrainian ministries, banks and metro systems were also affected.[51] It is said to have been the most destructive cyberattack ever.[52]

Among those affected elsewhere included British advertising company

DHL,[57] United States food company Mondelez International, and American hospital operator Heritage Valley Health System.[11][58] The Cadbury's Chocolate Factory in Hobart, Tasmania, is the first company in Australia to be affected by Petya.[59] On 28 June 2017, JNPT, India's largest container port, had reportedly been affected, with all operations coming to a standstill.[60] Princeton Community Hospital in rural West Virginia will scrap and replace its entire computer network on its path to recovery.[61]

The business interruption to Maersk, the world's largest container ship and supply vessel operator, was estimated between $200m and $300m in lost revenues.[49][62]

The business impact on FedEx is estimated to be $400m in 2018, according to the company's 2019 annual report.[63]

Jens Stoltenberg, NATO Secretary-General, pressed the alliance to strengthen its cyber defenses, saying that a cyberattack could trigger the Article 5 principle of collective defense.[64][65]

Mondelez International's insurance carrier,

Zurich American Insurance Company, has refused to pay out a claim for cleaning up damage from a Notpetya infection, on the grounds that Notpetya is an "act of war" that is not covered by the policy. Mondelez sued Zurich American for $100 million in 2018;[66] the suit was settled in 2022 with the terms of the settlement remaining confidential.[67]

Reaction

Europol said it was aware of and urgently responding to reports of a cyber attack in member states of the European Union.[12] The United States Department of Homeland Security was involved and coordinating with its international and local partners.[53] In a letter to the NSA,[68] Democratic Congressman Ted Lieu asked the agency to collaborate more actively with technology companies to notify them of software vulnerabilities and help them prevent future attacks based on malware created by the NSA.[34][69] On 15 February 2018, the Trump administration blamed Russia for the attack and warned that there would be "international consequences".[70] The United Kingdom and the Australian government also issued similar statements.[71]

In October 2020 the DOJ named further GRU officers in an indictment.[72] At the same time, the UK government blamed GRU's Sandworm also for attacks on the 2020 Summer Games.[73]

Other notable low-level malware

See also

References

  1. ^ a b c "Decrypting the Petya Ransomware". Check Point Blog. 11 April 2016. Archived from the original on 30 June 2017. Retrieved 27 June 2017.
  2. ^ a b Greenberg, Andy (22 August 2018). "The Untold Story of NotPetya, the Most Devastating Cyberattack in History". Wired. Archived from the original on 27 August 2018. Retrieved 27 August 2018.
  3. from the original on 26 March 2020. Retrieved 26 March 2020.
  4. ^ Kovacs, Edouard (16 February 2018). "U.S., Canada, Australia Attribute NotPetya Attack to Russia | SecurityWeek.Com". www.securityweek.com. Archived from the original on 26 March 2020. Retrieved 26 March 2020.
  5. ^ Gidwani, Toni (26 March 2020). "Identifying vulnerabilities and protecting you from phishing". Google. Archived from the original on 26 March 2020. Retrieved 26 March 2020.
  6. ^ a b c d e Constantin, Lucian (13 May 2016). "Petya ransomware is now double the trouble". NetworkWorld. Archived from the original on 31 July 2017. Retrieved 27 June 2017.
  7. Heise Online. Archived
    from the original on 22 September 2017. Retrieved 3 July 2017. Die Virenschreiber hinter diesen Erpressungstrojanern scheinen große Fans des Films zu sein. Wahrscheinlich sind sie in den Neunzigern aufgewachsen und identifizieren sich mit Boris Grishenko, dem russischen Hacker-Genie aus dem Film. Ob ein Twitter-Konto, welches genau auf dieses Profil passt, ein Bild von Boris Grishenko als Avatar nutzt und nach dem Verbrechersyndikat aus dem Film benannt ist, von den Drahtziehern betrieben wird, konnten wir nicht bestätigen. Aber es ist immerhin denkbar.
  8. ^ Iliyeva, Valery (7 August 2017). "На Дніпропетровщині викрили чоловіка, який розповсюджував вірус "Petya.A"". Dniprograd (in Ukrainian). Archived from the original on 7 September 2018. Retrieved 7 September 2018.
  9. ^ Muracha, Ivan (3 September 2018). "Регіональний "координатор" вірусу РЕТYА на Дніпропетровщині отримав один рік тюрми". Dniprograd (in Ukrainian). Archived from the original on 7 September 2018. Retrieved 7 September 2018.
  10. ^ "Оголошено вирок у справі за фактами масштабних кібератак вірусу "PETYA"". Judiciary of Ukraine. 31 August 2018. Archived from the original on 7 September 2018. Retrieved 7 September 2018.
  11. ^ a b c d e "Global ransomware attack causes chaos". BBC News. 27 June 2017. Archived from the original on 27 June 2017. Retrieved 27 June 2017.
  12. ^ a b Turner, Giles; Verbyany, Volodymyr; Kravchenko, Stepan (27 June 2017). "New Cyberattack Goes Global, Hits WPP, Rosneft, Maersk". Bloomberg. Archived from the original on 5 November 2019. Retrieved 27 June 2017.
  13. ^ a b c Wakefield, Jane (28 June 2017). "Tax software blamed for cyber-attack spread". BBC News. Archived from the original on 28 June 2017. Retrieved 28 June 2017.
  14. ProQuest 1913883917. Archived
    from the original on 13 April 2018. Retrieved 24 March 2023.
  15. ^ Lee, David (28 June 2017). "'Vaccine' created for huge cyber-attack". BBC News. Archived from the original on 28 June 2017. Retrieved 28 June 2017.
  16. ^ Наталія, Патрікєєва (3 July 2018). "Рік після атаки вірусу Petya: що змінилося в кібербезпеці України". radiosvoboda.org. Retrieved 28 March 2024.
  17. ^ Burgess, Matt. "There's another 'worldwide' ransomware attack and it's spreading quickly". Wired UK. Archived from the original on 31 December 2017. Retrieved 27 June 2017.
  18. ^ a b Turner, Giles; Al Ali, Nour (28 June 2017). "Microsoft, Analysts See Hack Origin at Ukrainian Software Firm". Bloomberg. Archived from the original on 28 June 2017. Retrieved 1 July 2017.
  19. ^ Stubbs, Jack; Polityuk, Pavel (3 July 2017). "Family firm in Ukraine says it was not responsible for cyber attack". Reuters. Archived from the original on 4 July 2017. Retrieved 5 July 2017.
  20. ^ from the original on 10 July 2017. Retrieved 10 July 2017.
  21. ^ Goodin, Dan (27 June 2017). "A new ransomware outbreak similar to WCry is shutting down computers worldwide". Ars Technica. Archived from the original on 30 June 2017. Retrieved 1 July 2017.
  22. ProQuest 1914424259. Archived
    from the original on 27 June 2017. Retrieved 28 June 2017.
  23. ^ a b "Ukrainian software company will face charges over cyber attack, police suggest". ABC News Australia. AP. 3 July 2017. Archived from the original on 10 July 2017. Retrieved 10 July 2017.
  24. ^ Goodin, Dan (5 July 2017). "Backdoor built in to widely used tax app seeded last week's NotPetya outbreak". Ars Technica. Archived from the original on 8 July 2017. Retrieved 10 July 2017.
  25. ^ Stubbs, Jack; Williams, Matthias (5 July 2017). "Ukraine scrambles to contain new cyber threat after 'NotPetya' attack". Reuters. Archived from the original on 7 July 2017. Retrieved 7 July 2017.
  26. ^ "Кардаков запропонував створити громадянську кібероборону". lb.ua. 20 July 2017. Retrieved 28 March 2024.
  27. ^ "New ransomware outbreak". Kaspersky Blog. Kaspersky Lab. Archived from the original on 27 June 2017. Retrieved 27 June 2017.
  28. ^ a b c Brandom, Russell (27 June 2017). "A new ransomware attack is hitting airlines, banks and utilities across Europe". The Verge. Archived from the original on 2 July 2017. Retrieved 27 June 2017.
  29. ^ "MIFR-10130295" (PDF). United States Computer Emergency Response Team. 30 June 2017. Archived (PDF) from the original on 15 August 2017. Retrieved 22 July 2017.
  30. ^ Goddin, Dan (14 April 2017). "NSA-leaking Shadow Brokers just dumped its most damaging release yet". Ars Technica. p. 1. Archived from the original on 13 May 2017. Retrieved 13 May 2017.
  31. ^ Thomson, Iain (28 June 2017). "Everything you need to know about the Petya, er, NotPetya nasty trashing PCs worldwide". The Register. San Francisco. Archived from the original on 12 July 2019. Retrieved 31 July 2019.
  32. ^ "India worst hit by Petya in APAC, 7th globally: Symantec". The Economic Times. 29 June 2017. Archived from the original on 29 June 2017. Retrieved 29 June 2017.
  33. ^ Cimpanu, Catalin (27 June 2017). "Petya Ransomware Outbreak Originated in Ukraine via Tainted Accounting Software". BleepingComputer. Archived from the original on 28 June 2017. Retrieved 29 June 2017.
  34. ^
    Techcrunch. Archived
    from the original on 29 June 2017. Retrieved 29 June 2017.
  35. ^ Suiche, Matt (28 June 2017). "Petya.2017 is a wiper not a ransomware". Comae Technologies. Archived from the original on 28 June 2017. Retrieved 29 June 2017.
  36. ^ a b Brandom, Russell (27 June 2017). "It's already too late for today's ransomware victims to pay up and save their computers". The Verge. Archived from the original on 27 June 2017. Retrieved 28 June 2017.
  37. ^ Goodin, Dan (28 June 2017). "Tuesday's massive ransomware outbreak was, in fact, something much worse". Ars Technica. Archived from the original on 17 July 2017. Retrieved 28 June 2017.
  38. ^ "Cyber-attack was about data and not money, say experts". BBC News. 29 June 2017. Archived from the original on 29 June 2017. Retrieved 29 June 2017.
  39. ^ Solon, Olivia; Hern, Alex (28 June 2017). "'Petya' ransomware attack: what is it and how can it be stopped?". The Guardian. Archived from the original on 30 May 2019. Retrieved 29 June 2017.
  40. ^ Cimpanu, Catalin (27 June 2017). "Vaccine, not Killswitch, Found for Petya (NotPetya) Ransomware Outbreak". Bleeping Computer. Archived from the original on 13 July 2017. Retrieved 29 June 2017.
  41. ^ Rogers, James (28 June 2017). "Petya ransomware: Experts tout 'vaccine' to protect computers from crippling cyber attack". Fox News. Archived from the original on 28 June 2017. Retrieved 29 June 2017.
  42. ^ McGoogan, Cara (28 June 2017). "Security researcher creates 'vaccine' against ransomware attack". The Telegraph. Archived from the original on 28 June 2017. Retrieved 29 June 2017.
  43. ^ Lee, Dave (28 June 2017). "'Vaccine' created for huge cyber-attack". BBC News. Archived from the original on 28 June 2017. Retrieved 29 June 2017.
  44. ^ @mikko (28 June 2017). "Victims keep sending money to Petya, but will not get their files back: No way to contact the attackers, as their email address was killed" (Tweet) – via Twitter.
  45. ^ "Analyzed: Internet Propagation and Recovery of Non-NTFS Victims". Alert Logic. Fortra. 26 July 2017. Archived from the original on 20 July 2020. Retrieved 20 July 2020.
  46. ^ a b Whittaker, Zack (27 June 2017). "Six quick facts to know about today's global ransomware attack". ZDNet. Archived from the original on 29 June 2017. Retrieved 29 June 2017.
  47. ^ Warren, Tom (13 May 2017). "Microsoft issues 'highly unusual' Windows XP patch to prevent massive ransomware attack". The Verge. Vox Media. Archived from the original on 14 May 2017. Retrieved 13 May 2017.
  48. ^ Newman, Lily Hay (27 June 2017). "A Scary New Ransomware Outbreak Uses WannaCry's Old Tricks". Wired. Archived from the original on 27 June 2017. Retrieved 29 June 2017.
  49. ^ a b Greenburg, Andy (22 August 2018). "The Untold Story of NotPetya, the Most Devastating Cyberattack in History". Wired. Archived from the original on 22 August 2018. Retrieved 1 September 2018.
  50. ^ Griffin, Andrew (27 June 2017). "Chernobyl's radiation monitoring system has been hit by the worldwide cyber attack". The Independent. Archived from the original on 26 May 2022. Retrieved 27 June 2017.
  51. ^ from the original on 13 April 2018. Retrieved 27 June 2017.
  52. ^ Ng, Alfred (15 February 2018). "US, UK say Russia behind 'most destructive' cyberattack ever". CNET. Archived from the original on 7 July 2022. Retrieved 24 March 2023.
  53. ^ a b Chappell, Bill; Dwyer, Colin (27 June 2017). "'Petya' Cyberattack Cripples Ukraine, And Experts Say It's Spreading Globally". The two way. NPR. Archived from the original on 27 June 2017. Retrieved 27 June 2017.
  54. ^ "Russia's Rosneft says hit by cyber attack, oil production unaffected". Reuters. 27 June 2017. Archived from the original on 27 June 2017. Retrieved 28 June 2017.
  55. ^ Ruuda, Lennart (28 June 2017). "Ehituse ABC sulges küberrünnaku tõttu kõik oma poed" [Ehituse ABC closed all its stores because of cyberattack]. Postimees (in Estonian). Archived from the original on 28 June 2017. Retrieved 28 June 2017.
  56. ^ Yeomans, Jon (6 July 2017). "Dettol maker Reckitt Benckiser warns revenue will be hit as it cleans up Petya cyber attack". The Telegraph. Archived from the original on 8 July 2017. Retrieved 9 July 2017.
  57. ^ "Hackerangriff: Beiersdorf & Co hart getroffen" [Hacking attack: Beiersdorf and other companies badly affected]. ARD. 6 July 2017. Archived from the original on 6 July 2017. Retrieved 9 July 2017.
  58. from the original on 1 May 2021. Retrieved 27 June 2017.
  59. ^ "Petya cyberattack: Hobart's Cadbury chocolate factory struck". The Australian. Retrieved 28 June 2017.
  60. ^ "New malware hits JNPT operations as APM Terminals hacked globally". The Indian Express. 27 June 2017. Archived from the original on 1 July 2017. Retrieved 28 June 2017.
  61. ^ Evans, Melanie (30 June 2017). "Business News: Hospital Is Forced To Scrap Computers". The Wall Street Journal. Archived from the original on 2 July 2017. Retrieved 2 July 2017.
  62. ZDNet. Archived
    from the original on 17 February 2018. Retrieved 18 February 2018.
  63. ^ 2019 Annual Report (PDF) (Report). FedEx Corporation. p. 67. Archived (PDF) from the original on 2 July 2021. Retrieved 24 March 2023. Comparables for 2019 are affected by the impact of the NotPetya cyberattack, which reduced earnings in 2018 by approximately $400 million
  64. ^ Uchill, Joe (28 June 2017). "Overnight Cybersecurity: New questions about 'ransomware' attack—Tensions between NSA chief, Trump over Russia—Senate panel asks states to publicize election hacks". The Hill. Archived from the original on 30 June 2017. Retrieved 29 June 2017.
  65. ^ "NATO Warns Use of Article 5 Over Cyber Attack, Members Pledge Spending Increase". Haaretz. Reuters. 28 June 2017. Archived from the original on 24 March 2023. Retrieved 24 March 2023.
  66. ^ McCarthy, Kieran (11 January 2019). "Cyber-insurance shock: Zurich refuses to foot NotPetya ransomware clean-up bill—and claims it's 'an act of war'". The Register. Archived from the original on 2 February 2019. Retrieved 2 February 2019.
  67. ^ Jones, David (8 November 2022). "Mondelēz settlement in NotPetya case renews concerns about cyber insurance coverage". Cybersecurity Dive. Archived from the original on 21 January 2023. Retrieved 24 March 2023.
  68. ^ Lieu, Ted. "Letter to NSA director" (PDF). House. Archived (PDF) from the original on 6 July 2017. Retrieved 29 June 2017.
  69. ^ Auchard, Eric; Stubbs, Jack; Prentice, Alessandra (27 June 2017). "New computer virus spreads from Ukraine to disrupt world business". Reuters. Archived from the original on 28 June 2017. Retrieved 24 March 2023.
  70. ^ Chalfant, Morgan (15 February 2018). "Trump admin blames Russia for massive global cyberattack". The Hill. Archived from the original on 6 October 2022. Retrieved 24 March 2023.
  71. ^ Shaikh, Rafia (16 February 2018). "US, UK, Australia Warn Russia of "International Consequences" - NotPetya Outbreak Attributed to the Kremlin". WCCF Tech. Archived from the original on 29 September 2022. Retrieved 24 March 2023.
  72. U.S. Department of Justice. 19 October 2020. Archived
    from the original on 10 December 2021. Retrieved 20 October 2020.
  73. from the original on 20 October 2020. Retrieved 20 October 2020.

Further reading