Many Firms Hit by Global Cyber Attacks - Petrwrap

Another attack which can be put at the door of Wikileaks due to their release of all the vulnerabilities. So I wonder if those normal users who get hit who have supported the work of Wikileaks will continue to do so when they lose their data?

This is what I have just seen on Webroots Twitter feed.

June 27, 2017  By Catalin Cimpanu
 
                                  

 
Today's massive ransomware outbreak was caused by a malicious software update for M.E.Doc, a popular accounting software used by Ukrainian companies.

According to several researchers, such as Cisco Talos, ESET, MalwareHunter, Kaspersky Lab, and others, an unknown attacker was able to compromise the software update mechanism for M.E.Doc's servers, and deliver a malicious update to customers.

When the update reached M.E.Doc's customers, the tainted software packaged delivered the Petya ransomware — also referenced online as NotPetya, or Petna.
 
Full Article.

New ransomware, old techniques: Petya adds worm capabilities
On June 27, 2017 reports of a ransomware infection began spreading across Europe. We saw the first infections in Ukraine, where more than 12,500 machines encountered the threat. We then observed infections in another 64 countries, including Belgium, Brazil, Germany, Russia, and the United States.
 
The new ransomware has worm capabilities, which allows it to move laterally across infected networks. Based on our investigation, this new ransomware shares similar codes and is a new variant of Ransom:Win32/Petya. This new strain of ransomware, however, is more sophisticated.
Read more: Blogs Technet

 
June 28, 2017  By Catalin Cimpanu
 
                                          

 
The NotPetya ransomware that encrypted and locked thousands of computers across the globe yesterday and today is, in reality, a disk wiper meant to sabotage and destroy computers, and not ransomware. This is the conclusion of two separate reports coming from Comae Technologies and Kaspersky Lab experts.
 
Experts say that NotPetya — also known as Petya, Petna, ExPetr — operates like a ransomware, but clues hidden in its source code reveal that users will never be able to recover their files.
 
This has nothing to do with the fact that a German email provider has shut down the NotPetya operator's email account. Even if victims would be able to get in contact with the NotPetya author, they still have no chance of recovering their files.
 
Full Article.
 

Ordinary decent cybercriminal... or?

By John Leyden 29 Jun 2017
 
A Twitter user purporting to speak for the cybercrime group behind the original Petya ransomware has claimed they want to help "repair" the damage caused by this week's attack.
 
The Twitter account Janus Cybercrime Solutions (@JanusSecretary), which went dark for a time after the original Petya outbreak, was reactivated on Thursday – and it's not down with the chaos caused in Ukraine and beyond this week following the spread of somewhat similar code that encrypted compromised systems.
 
Full Article.

• NATO says a "state actor" was behind the recent cyberattack.
• The cyberattack could be interpreted as an act of war, triggering Article 5.
• The attack was designed to cause disruption, not to make financial gains, according to experts.

Luke GrahamFriday, 30 Jun 2017
 
A "state actor" was behind the cyberattack that hit over 12,000 devices in around 65 countries on Tuesday hitting major industries from advertising to oil, according to NATO.
 
The "Petya" ransomware attack encrypted files on a computer and demanded $300 worth of the cryptocurrency bitcoin in order to unlock them. Kaspersky Lab estimates at least 2,000 targets were affected, mostly in Russia and the Ukraine, but attacks were registered in several other countries, including Germany, the U.K. and China.
 
Full Article.