What is it?
It wasn’t long since the massive WannaCry ransomware hit the cyber-world, and starting from yesterday, Tuesday June 27th, a massive new attack of the ransomware variant has been identified, affecting organizations around the globe (wired article).
This ransomware is a new version Petya, also known as NotPetya (as it is a variant that borrows code from Petya but it’s different) and has other different names as Petrwarp, Nyetra, SortaPetya and Petna.
The attack first took place in Ukraineand started spreading quickly throughout the world. It is reported by Kaspersky that more than 2000 organizations globally are infected, including Maersk, Rosneft, and many others. The result of the attack is a large scale power-down of sites and services around the globe, with a major effect on daily business and logistics.
Why is it so dangerous?
This ransomware is more aggressive compared to WannaCry, as it encrypts the MFT (Master File Tree) tables for NTFS partitions and overwrites the MBR (Master Boot Record) with a custom bootloader that shows a ransom note and prevents victims from booting their computer. It’s also forcefully reboots systems and prevents them from working altogether.
This ransomware also contains advanced propagation techniques that makes it more dangerous than any ransomware before.
Why can the attack spread so fast?
After infecting a single machine the ransomware then propagates using several techniques, one of them is in a similar fashion as WannaCry; through exploitation EternalBlue.
Another propagation technique includes stealing of credentials and exploiting users’ permissions and using legitimate methods of connecting to other hosts.
This what makes the current ransomware more dangerous compared to WannaCry that uses only the EternalBlue exploit, as credentials harvesting results in very fast lateral movement. It spreads like an oil spill with a logarithmic character.
If only 1 computer is infected in the network and this computer stores login credentials of a network administrator, the entire network is compromised.
Technically speaking, the ransomware uses PsExec, WMI and SMB connections via ADMIN$ in order to propagate in the LAN.
It then tries to forcefully reboot the system and also creates a scheduled task to reboot the infected system one hour after the initial infection. The full encryption happens when the system reboots. It is not 100% clear if no encryption happens prior to the reboot.
Where does it come from?
At this point there are no clear indicators where the attack comes from. With information currently available, it is suggested that Petya was deployed onto potentially several millions of computers by hacking Ukrainian accounting software called “MeDoc”. It then used their automatic update feature to download the malware onto all computers using the software.
Although MeDoc being the initial infection vector is unconfirmed (andeven denied by the company itself), current evidence points to them (source1, source2, source3).
Who are or can be affected?
It appears a Windows only variant so far. So Windows users are at risk.
Multiple large enterprises are hit: Maersk, TNT, and several Ukrainian entities are amongst them.
Any other Windows-based organization can be hit as well.
How can we protect our company?
We in Comsec recommend the following recommendations, prevention and mitigation measures:
- It is recommended to make all employees aware of this event to make sure suspicious emails are not opened and any suspicious email or activity is reported to the relevant IT personnel.
- Obtain and patch systems to the latest version using the manufacturer security update, as it is likely to believe that Petya is actively exploiting known vulnerabilities inside networks. (TechNet Article)
- For unsupported or unpatched systems, it is recommended to isolate them from the network and to consider shutting them down if possible. Alternatively, Microsoft released a security update for the SMB vulnerability also for Windows platforms that are in custom support only, including Windows XP, Windows 8, and Windows Server 2003 (Technet Article. The system update is available here: KB4012598
- Disable SMBv1 in all unpatched machines, and in all machines where it does not impact their business purpose.
- Isolate communication UDP ports 137 and 138 as well as TCP ports 139 and 445 in networks to avoid spreading or infection.
- Update all AntiVirus and AntiMalware products signatures
- Make sure all the organization’s critical data is backed up both in online and offline backup storage.
- If possible, block the ADMIN$ share in the network. The worm uses this share with WMI to spread itself, thus disallowing access prevents the possible spread.
- If you are infected, do not pay the 300$ asked ransom fee. The e-mail address referred to is no longer in service. The decryption key will not be received when you pay the fee.
- The malware tries to reboot immediately and then again after 30-60 minutes. If infection is identified (pretends to be a windows CheckDisk scan) shut down the infected machine immediately.
- In the recent hours it was found that a vaccine is available to prevent infection of a host. Create 3 read-only files named perfc, perfc.dll and perfc.dat in C:Windows. This can be done by using the following script file (rename to vaccine.bat and execute in the entire domain using the GPO). It has to be noted that the vaccin works only if the executed / inject dll matches the exact name ‘perfc’
@echo off
echo Administrative permissions required. Detecting permissions…
echo.
net session >nul 2>&1
if %errorLevel% == 0 (
if exist C:Windowsperfc (
echo Computer already vaccinated .
echo.
) else (
echo Vaccination file. > C:Windowsperfc
echo Vaccination file. > C:Windowsperfc.dll
echo Vaccination file. > C:Windowsperfc.dat
attrib +R C:Windowsperfc
attrib +R C:Windowsperfc.dll
attrib +R C:Windowsperfc.dat
echo Computer vaccinated.
echo.
)
) else (
echo Failure: You must run this batch file as Administrator.
)
pause
We can help you, just ask!
Comsec is constantly tracking the recent developments in the world and we update our blog accordingly. We are ready to assist with any questions or requests that you may have.
For further questions or help, please contact: timt@comsecglobal.comor gilc@comsecglobal.com
