All you need to know about Petna - Virus-extortion of the Petya family. Petya virus: how not to catch how to decipher where the latest news about Petya encrypter (EXPETR) message about Petya virus

This conclusion was the result of the study at once two companies - Comae Technologies and Kaspersky Lab.

The original Hollower Petya, discovered in 2016, was a car for making money. This sample is definitely not intended for earnings. The threat is created for rapid propagation and damage and disguised as an encrypter.

NotPety is not a means of cleaning the disc. The threat does not delete the data, but simply makes them unsuitable for use, blocking files and "throwing out" keys to decryption.

Senior Researcher from the "Kaspersky Lab" Juan Andre Gerrero-Saade commented on the situation:

In my book, infection with the extortion program without a possible decryption mechanism is equivalent to cleaning the disk. Not paying attention to the viable decryption mechanism, the attackers showed a complete disregard for long-term monetary benefits.

The author of the original Encipher Petya wrote on Twitter that he was not associated with the development of NotPetya. It has already become a second cybercrime, which denies involvement in creating a new similar threat. Earlier, the author of the AES-NI cipher stated that he had no relation to XDATA, which was also used in targeted attacks to Ukraine. In addition, XDATA, as well as notpetya, used the identical distribution vector - servers of updates of the Ukrainian manufacturer of software for accounting.

Many indirect signs confirm the theory that someone hacks famous encrypters and uses modified versions for attack on Ukrainian users.

Destructive modules under the type of encrypter - already ordinary practice?

Such cases have already met before. The use of malicious modules for irreversible damage to files under the guise of ordinary encrypters is far from a new tactic. In the modern world, this is already becoming a tendency.

Last year, Shamoon and Killdisk malware families included "Components of Encrybers" and used similar techniques for the destruction of data. Now even industrial malware receives disk cleaning functions.

NOTPETYA Classification As a means of data destruction can be easily transferred to a malicious program in the category of cyberradiation. In this case, the analysis of the consequences of the threat should be considered from another perspective.

Considering the initial point of infection and the number of victims, it becomes obvious that the purpose of the hacker attack was Ukraine. At the moment there are no obvious evidence pointing to the attacking finger, but Ukrainian officials have already accused Russia, which they also accused of past cyber incidents, starting in 2014.

NotPety may be on the same level with well-known families of Stuxnet and BlackEnergy families, which were used for political purposes and for devastating effects. Certificates clearly show that notpetya is cyberoreuzzi, and not just a very aggressive type of encrypter.

Petya's Virus-extortion attacked computers of Ukraine, Russia, Sweden, Holland, Denmark and other countries. The very appearance of the virus is recorded in Asia: a system of cargo traffic management of the largest container port has failed in India. However, Ukraine suffered most of all - Kharkov Airport is completely paralyzed, at the airport Borispol work is restored, but the main server still does not work. About 300 thousand computers are blocked, the user must pay 300 dollars for unlocking data. At the moment, the hackers paid about $ 5,000 from 20 users, reports NEXT Web.

Who is guilty?

At night, the Department of Cyberpolyting National Police of Ukraine reported on a Facebook page that the attack on Ukraine was carried out through the program for reporting and document management "M.E.DOC":

Policemen report that the attack began at 10:30 Moscow time, after the software developers rolled out the next update. At the same time, the authors of programs for automation of document management themselves are categorically denying and leading detailed arguments:

Later, a message appeared on the cyberprovation page that they are not accused M.E.Doc, but only state: identified the facts that should be checked in detail. However, the update is still not recommended:

Who is Petya?

As experts Positive Technologies told the site, it is a malware, the principle of operation of which is based on encryption of the main boot record (MBR) of the disk boot sector and replacing it with its own.

Even after the computer is infected, the user remains 1-2 hours, for which you can have time to run the bootrec / fixmbr command to restore the MBR and restore the operability of the OS, but the files will not be able to decrypt.

In addition, Petya is able to bypass the security updates of the system that were installed after the Wannacry attack, so it is so effective and applies to other computers avalanche-like. He fights for control over all the nodes of the domain, which is equivalent to the full compromise infrastructure.

The attack of the virus on the computers of Ukrainian public and private companies began at 11:30. Large banks, trading networks, cellular operators, state-owned companies, infrastructure facilities and services of the service sector have been under the blow.

The virus covered the entire territory of Ukraine, by 17:00 there was information that the attack was recorded and in the west of the country, in Transcarpathia: here in connection with the virus were closed branches of the bank "OTR" and Ukrsotsbank.

"The KorRespondent.net website and TV channel" 24 "does not work in Ukraine. The number of companies that suffered from attack increases every hour. Currently, a majority of banking offices are not working in Ukraine. For example, in Ukrsotsbank offices, computers are simply not loaded. It is impossible to get or send money, pay for receipts and so on. At the same time, there are no problems in PrivatBank, "the Kyiv correspondent RT reports.

The virus affects only computers that work on the Windows operating system. It encrypts the main table of the hard disk files and extorts users of money for decoding. In this, it is similar to Wannacry's virus-extortionist, whose attacks have undergone many companies around the world. At the same time, the results of checking infectious computers appeared, which showed that the virus destroys all or most of the information on infected disks.

At the moment, the virus is identified as MBR Locker 256, but in the media it turned out the other name - Petya.

From Kiev to Chernobyl

The virus struck the Kiev metro, where it is currently difficulty with paying bank cards.

Many large infrastructure facilities are affected, such as the Ukrzalisnica State Railway Operator, Borispol Airport. However, while they work in normal mode, the air navigation systems did not affect the virus, although Borispol has already published a warning about possible changes in the schedule, and at the airport, the panel of arrival does not work.

In connection with the attack, there are difficulties in the work of the two largest postal operators of the country: the state "Ukrpochta" and private "New Mail". The latter stated that today there will be no charge for posting parcels, and Ukrpochta is trying to minimize the consequences of attacks with the help of the SBU.

In connection with the risk of infection, the sites of those organizations that the virus did not affect. For this reason, for example, the site servers of the Kiev City State Administration, as well as the site of the Ministry of Internal Affairs of Ukraine.

Ukrainian officials are quite predictable claim that attacks are committed from Russia. This was said to the secretary of the Council of National Security and Defense of Ukraine Alexander Turchinov. "Already, by conducting a primary analysis of the virus, you can talk about the Russian footprint," the official website quotes his official website.

By 17:30, the virus even got to the Chernobyl nuclear power plant. About this edition of the Ukrainian Pravda reported by the head of the change of CHAES Vladimir Ilchuk.

"There is preliminary information that some computers have been infected with a virus. Therefore, as soon as this hacker attack began, a personal team of computer workers in the field of staff computers were turned off, "said Ilchuk.

Attack on sweets and oil and gas

Some Russian companies, including oil and gas giants Rosneft and Bashneft, Metallurgical Company EVRAZ, Bank Home Credit, whose branches were suspended, and MARS, MARS, Nivea, and MONDELEZ International, MARS, Nivea, Mondelez International, also underwent , TESA and a number of other foreign companies.

  • Reuters.
  • Maxim Shemetov.

Around 14:30 Moscow time in Rosneft announced the holding of a powerful hacker attack on the company servers. At the same time, the company's microblog in Twitter notes that the attack could lead to serious consequences, but thanks to the transition to the backup system of production processes, neither mining nor the preparation of oil was stopped.

After kiberataki, Rosneft and Bashneft companies have become unavailable for some time. Rosneft also declared the inadmissibility of distributing false information about the attack that occurred.

"Distributors of false panic reports will be considered as accomplices of organizers of attack and with them to bear responsibility," the company reported.

At the same time, "Rosneft" noted that on the fact of Kiberataki, the company appealed to law enforcement agencies, and expressed the hope that the incident was not related to "with current judicial procedures." On Tuesday, June 27, the Arbitration Court of Bashkiria began its consideration on the merits of Rosneft, "Bashneft" and Bashkiria to AFC Sistema in the amount of 170.6 billion rubles.

Wannacry Jr.

At the same time, the hacker attack did not affect the work of computer systems of the Presidential Administration of Russia and the official website of the Kremlin, who, as the TASS press secretary of President Dmitry Sadkov, "works stable", "works stable.

Hacker Attack also did not affect the work of Russian nuclear power plants, noted in the Rosenergoatom concern.

DR. Web on its website stated that, despite the external similarity, the current attack was performed using a virus, different from the already known malware-extortionable PETYA, in particular, the mechanism of the proliferation of the threat.

"Among the victims of Kiberataki, the network of" Bashneft ", Rosneft, Mondelez International, Mars, Nivea, Tesa and others," the company's message quotes the agency. At the same time, the press service of MARS in Russia said that Kiberatak caused problems with IT systems only at the Royal Canin brand, animal feed producer, and not the entire company.

The last major hacker attack on Russian companies and government agencies occurred on May 12 as part of a large-scale operation of unknown hackers attacked by Windows OS 74 through the Wannacry encryptionist virus.

On Tuesday, the head of the International Committee of the Federation Council Konstantin Kosachev, speaking at a meeting of the Commission of the Council for the Protection of State Sovereignty, said that about 30% of all Kiberatak to Russia was performed from the United States.

"From the Russian territory, American computers are performed by no more than 2% of the total number of cyber, while from the territory of the United States to the Russian electronic infrastructure - 28-29%," the words of Kosachev RIA Novosti leads.

According to the head of the international research team "Kaspersky Lab" Kostina Rayy, Petya's virus has spread to many countries of the world.