New ransomware campaign known as Petya

Published: Wed 28 Jun 2017 10:11 AM
28 Jun 2017
New ransomware campaign known as Petya
First published at 9.30am
[Original version/updates]
A new ransomware campaign known as Petya is affecting computer networks using Microsoft Windows. It was first seen affecting systems in the Ukraine, but is quickly spreading across other computer networks in Europe.
To help prevent an attack, it’s critical to ensure that all systems in a network are patched. Petya gets into unpatched versions of Windows systems (XP through 2008 R2) by exploiting a vulnerability in Microsoft's Windows SMB server. If Petya enters a network through an unpatched system, it will be able to spread to any other trusted systems in the same network, even if they have been patched.
This vulnerability exploited by Petya is known as EternalBlue. Microsoft released a patch for EternalBlue, called MS17-010, in March this year.
The ransomware encrypts not only the file system on affected computers but also the Master Boot Record (MBR) in environments where the malware is able to do so.
EternalBlue vulnerability patch MS17-010 External Link/
Read more about EternalBlue External Link/
What to do
Initial reports suggest Petya ransomware is spreading via a software vulnerability in Microsoft Windows operating systems.
• Make sure you've patched all systems in your network. Organisations using any Windows system between XP and 2008 R2 should ensure that mitigations are in place - particularly the MS17-010 Microsoft patch.
• Make sure you've backed up your system and have stored your files securely outside your network.
• If you’re not patched, consider turning the system off or disabling SMBv1 - this will stop some file sharing. These operating systems need to be either turned off or have SMBv1 disabled.
• Be careful when opening emails and clicking on links or attachments within them. They could be phishing emails that look like they've been sent by a person or organisation you know and trust.
• Ensure staff are aware of this campaign. Remind them to be vigilant about links and attachments contained in incoming emails.
If Petya enters your system, it will encrypt your files, blocking access to them and demanding you pay a ransom to get them back. This is what you’ll see if Petya is attempting to encrypt your files:
If you see this, turn your computer off, and don’t turn it on again. An IT specialist should be able to recover your files directly from the hard drive. If you turn your computer back on again and Petya encrypts them, there’s currently no way to retrieve them as the email address used in paying the ransom has been shut down.
More information
If you require more information or further support, submit a report on our website or contact us on 0800 CERTNZ.
Report an incident to CERT NZ

Next in Business, Science, and Tech

Australian bushfires continue to blaze – Expert Reaction
By: Science Media Centre
Higher retail consumption lifts GDP
By: Statistics New Zealand
Fairer pay with minimum wage rise for quarter of a million
By: New Zealand Government
Tourism and Environment: Pristine, popular... imperilled?
By: Parliamentary Commissioner For The Environment
Gordon Campbell on the Aussie bush fires and Suleimani
By: Gordon Campbell
Bushfire Crisis: Climate Politics Turning Point Aus Needs?
By: The Conversation
Scott Morrison: the bushfires demand a climate policy reboot
By: The Conversation
Incendiary Extinctions: Australian Fires
By: Binoy Kampmark
Aussie bushfire smoke reaches NZ – update 2nd Jan 2020
2019 NZ's fourth warmest year on record - Expert Reaction
By: Science Media Centre
2019 second hottest year on record, UN confirms
By: UN News
Fossil Fuel Companies Called On To Foot Australia Fires Bill
By: Eoin Higgins
GDP growth reflects a strong economy
By: New Zealand Government
NZ in ‘GDP per person recession’ under Labour
By: New Zealand National Party
View as: DESKTOP | MOBILEWe're in BETA! Send Feedback © Scoop Media