{"id":1061,"date":"2017-06-28T08:49:14","date_gmt":"2017-06-28T08:49:14","guid":{"rendered":"https:\/\/gomiedesign.co.uk\/?p=1061"},"modified":"2017-06-28T08:49:14","modified_gmt":"2017-06-28T08:49:14","slug":"psa-petya-ransomware-affecting-critical-systems-globally-heres-what-to-do","status":"publish","type":"post","link":"https:\/\/gomiedesign.co.uk\/?p=1061","title":{"rendered":"PSA: Petya Ransomware Affecting Critical Systems Globally: Here\u2019s What to Do."},"content":{"rendered":"

Updated 3:19 pm Pacific Time: A method to ‘immunize’ yourself against this ransomware variant has been found. I have posted the details towards the end of the post along with the batch file you are running. This file is as simple as creating C: \\ Windows \\ perfect and marking it as read-only.<\/span><\/p>\n

Update PST 2 on Tuesday at 7 pm: The initial transition has come from a company called Maycock that dissolved. Their systems were infected, and they then gave an update to spread the infection. Maycock is disputing the charge. Sources: Talos quoted on ZosNet, Forbes, and FireEye.<\/span><\/p>\n

This is a public service announcement from Wordfence due to the widespread and severe nature of this attack. A major ransomware attack targeting Microsoft Windows systems is affecting companies and systems, many of them globally significant.<\/span><\/p>\n

What We Know<\/h2>\n

At the time of this writing, a new ransomware version is spreading rapidly around the world. There is no consensus in the security research community, so the following information is provisional:<\/span><\/p>\n

Ransomware has been dubbed “Petya.” It spreads using two different adventures. You do not need to click on anything or take any action. It can spread through the network in your system. This is why it is having such a broad impact and why you must update your order for your security.<\/span><\/p>\n

For the technically minded: This ransomware is exploiting a vulnerability in Microsoft Office when handling RTF documents (CVE-2017-0199). It uses a vulnerability in SMBv1, which is the Microsoft file-sharing protocol. This second vulnerability is described in Microsoft Security Bulletin MS17-010.<\/span><\/p>\n

Ransomware has affected a large number of companies, organizations, and governmental organizations internationally. The following is a screenshot of the ransomware page you are facing after your files are encrypted:<\/span><\/p>\n

\"\"<\/a><\/p>\n

Colin Hardy has provided a behavioral analysis of Petya, including a video demonstration of malware in action:<\/span><\/p>\n