NotPetya ransomware: White House joins UK in blaming Russia for NotPetya cyberattack
US government claims to be “reviewing a range of options" in response to the findings

28/06/2017: Vaccine may hinder Petya spread
Security researchers have chanced upon a workaround solution that disables the Petya ransomware that's wreaked havoc on computers around the world.
According to a blog post by IT security firm Cybereason, its principle security researcher Amit Serper discovered that creating a file named "perfc", with no extension name and placing it in the C:\windows\ folder. The file has to be read-only for the method to work.
The ransomware searches for its own filename in the C:\windows\ folder, and if it is found, will cease running, according to security researchers.
Cybereason said that once the original file name was found and verified by two different sources, Serper was able to piece together a kill switch that should work for any instance of the original ransomware infection. While this does not stop the ransomware if it is already running, it will act as a vaccination, stopping it from ever trying to encrypt files.
While Petya infects PCs around the world, Kroll Ontrack believed that some data may still be salvaged from infected computers without paying a ransom.
According to Phil Bridge, managing director, Western Europe of Data & Storage Technologies at Kroll Ontrack, said that the malware does not encrypt all the files on your computer but instead attacks a part of the operating system called the Master File Table (MFT), an essential index' for the computer system to locate files on the computer.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
"Attacking one part of the system (the MFT) is much faster than targeting all the individual files but the result is as if each file had been locked separately," he said.
He added that there is a method to decrypt the original Petya ransomware, but one has not yet been released for the updated version. He said that "some data may still be salvaged from infected computers with the use of specialist data recovery techniques.
28/06/2017: Petya ransomware: attack hits global companies
A ransomware attack has locked down corporate computers throughout Europe and the US, a month after the NHS and other organisations were knocked offline by WannaCry.
Called Petya as well as NotPetya by some, and Goldeneye, by others has reportedly hit thousands of machines, including at advertising giant WPP, Danish transport firm AP Moller-Maersk, and Russian oil firm Rosneft, as well as at least one hospital firm in the US.
It appears to have initially infected machines via accounting software that companies use to link to the Ukrainian government, with huge swathes of that country's companies and government bodies wiped offline. While the country's Twitter feed made light of the situation, some of the shutdown was alarming including Chernobyl radiation monitoring being done by hand.
Once in, Petya then spreads via the EternalBlue vulnerability in Windows that has been patched but given the carnage, it appears not everyone has updated. That was the same exploit used by WannaCry's hackers, and was developed by the NSA but leaked in April.
"As far as the EternalBlue exploit, the worm code appears to heavily borrow from WannaCry, including taking advantage of the same EternalBlue exploit code to move around once it is inside the network," said Allan Liska, intelligence architect at Recorded Future. "In addition to the EternalBlue exploit, the new attack appears to take advantage of WMIC for lateral movement. WMIC (Windows Management Instrumentation Command-line) is a command line tool that is used to execute system management commands on Windows."
One difference with WannaCry is it lacks an apparent "kill switch" that halted May's ransomware outbreak. "Some are comparing this to WannaCry 2.0 but this version does not have the "kill-switch" that the original WannaCry did. Thus, we should not expect any oddity like that to slow this attack," said Brian Hussey, VP of cyber threat detection and response at Trustwave.
This variant demands $300 in Bitcoin payment from users of infected machines as ransom to unlock their data. However, the German email provider, Posteo, that runs the attackers' email account, has shut it down, so victims likely won't be getting their data decrypted.
To Nicholas Weaver, security researcher at the International Computer Science Institute, that suggests there may be more to Petya. "I'm willing to say with at least moderate confidence that this was a deliberate, malicious, destructive attack or perhaps a test disguised as ransomware," Weaver told KrebsonSecurity. "The best way to put it is that Petya's payment infrastructure is a fecal theater."
Matthew Hickley, co-founder of My HackerHouse, said if your computer does force a reboot and show the following screen, turn your PC off to halt the encryption process.
-
Prolific ransomware operator added to Europe’s Most Wanted list as US dangles $10 million reward
News The US Department of Justice is offering a reward of up to $10 million for information leading to the arrest of Volodymyr Viktorovych Tymoshchuk, an alleged ransomware criminal.
-
Jaguar Land Rover “did the right thing” shutting down systems to thwart cyber attack
News The attack on Jaguar Land Rover highlights the growing attractiveness of the automotive sector
-
Ransomware attack on IT supplier disrupts hundreds of Swedish municipalities
News The attack on IT systems supplier Miljödata has impacted public sector services across the country
-
A notorious hacker group is ramping up cloud-based ransomware attacks
News The Storm-0501 threat group is refining its tactics, according to Microsoft, shifting away from traditional endpoint-based attacks and toward cloud-based ransomware.
-
Security researchers have just identified what could be the first ‘AI-powered’ ransomware strain – and it uses OpenAI’s gpt-oss-20b model
News Using OpenAI's gpt-oss:20b model, ‘PromptLock’ generates malicious Lua scripts via the Ollama API.
-
Data I/O shuts down systems in wake of ransomware attack
News Regulatory filings by Data I/O suggest the costs of dealing with the attack could be significant
-
Average ransom payment doubles in a single quarter
News Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
-
BlackSuit ransomware gang taken down in latest law enforcement sting – but members have already formed a new group
News The notorious gang has seen its servers taken down and bitcoin seized, but may have morphed into a new group called Chaos