Menu
Hackers use dangerous Petya ransomware in targeted attacks

Hackers use dangerous Petya ransomware in targeted attacks

The attackers patch Petya on the fly to use their own encryption key, bypassing the malware's original creators in the process

In a case of no honor among thieves, a group of attackers has found a way to hijack the Petya ransomware and use it in targeted attacks against companies without the program creators' knowledge.

A computer Trojan dubbed PetrWrap, being used in attacks against enterprise networks, installs Petya on computers and then patches it on the fly to suit its needs, according to security researchers from antivirus vendor Kaspersky Lab.

The Trojan uses programmatic methods to trick Petya to use a different encryption key than the one its original creators have embedded inside its code. This ensures that only the PetrWrap attackers can restore the affected computers to their previous state.

The Trojan also removes all mentions of Petya from the ransom message, as well as its signature red skull designed in ASCII.

Petya first appeared a year ago and immediately stood out from other ransomware programs. Instead of encrypting files directly, it replaces the hard drive's master boot record (MBR) code, which normally starts the operating system, with malicious code that encrypts the drive's master file table (MFT).

The MFT is a special file on NTFS volumes that contains information about all other files: their name, size, and mapping to hard disk sectors. The actual contents of the user's files are not encrypted, but without the MFT, the OS no longer knows where those files are located on disk.

Unlike other ransomware infections that only lock access to certain files by encrypting them, Petya locks access to the entire computer. With a corrupted MBR and MFT, the operating system will no longer start, and users will only be greeted by a ransom message on the screen when they turn on their computer.

The decision to hijack and use Petya without its authors' consent is clever because it solves several problems for the PetrWrap attackers. First of all, they don't have to write their own ransomware program, which is hard to get right, and they don't have to pay someone else for a ready-made solution either.

Second, because it has been around for a while, Petya has had time to mature into a well-developed piece of malware. The PetrWrap attackers use Petya version 3, the latest variant of the program, which, unlike previous versions, has no known flaws. That's because its creators have perfected their encryption implementation over time.

Creating something like Petya from scratch would not only be prone to errors but would also require knowledge of writing low-level bootloader code for the MBR.

Once inside a network, the PetrWrap attackers look for and steal administrative credentials. They then use the PsExec tool to deploy the malware to all endpoint computers and servers they can access.

There is no tool to decrypt the MFT of hard disk volumes affected by Petya, but because this malware doesn't actually encrypt the file contents, some data recovery tools might be able to reconstruct the files from hard disk raw data.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

Meet the leading female front runners of the Kiwi channel

Meet the leading female front runners of the Kiwi channel

Reseller News honoured the leading female front runners of the New Zealand channel at the 2018 Women in ICT Awards (WIICTA) in Auckland. The awards honoured standout individuals across seven categories, spanning Entrepreneur; Innovation; Rising Star; Shining Star; Community; Technical and Achievement.

Meet the leading female front runners of the Kiwi channel
Meet the top performing customer-centric Microsoft channel partners

Meet the top performing customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the top performing customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments