{"id":9545,"date":"2017-06-29T10:54:23","date_gmt":"2017-06-29T17:54:23","guid":{"rendered":"http:\/\/blog.hellotech.com\/?p=9545"},"modified":"2021-06-12T07:07:30","modified_gmt":"2021-06-12T14:07:30","slug":"notpetya-ransomware","status":"publish","type":"post","link":"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware","title":{"rendered":"New Ransomware, NotPetya, Quickly Spreading Across the Globe Just Weeks After WannaCry"},"content":{"rendered":"\n

Just a month after 300,000 computers worldwide were affected by WannaCry, a new ransomware threat, called NotPetya is attacking government agencies and major private firms around the world.<\/p>\n\n\n\n

Emerging news show that the attack began on Tuesday, with the first confirmed reports coming from Ukraine and Russia. Throughout the day, various companies from the United Kingdom, the United States, and across Europe and Asia also reported that their systems were hit.<\/p>\n\n\n\n

\"New<\/span>
Malware researcher, Lukas Stefanko, tweeted about the attack and showed images of corrupted computers.<\/figcaption><\/figure><\/div>\n\n\n\n

Researchers were eyeing a link to WannaCry, but security experts who investigated the attack stated it was an entirely new strain of ransomware<\/a> after confirming the virus wasn\u2019t a variant of the Petya ransomware<\/a>. The malware is currently being nicknamed as \u201cNotPetya\u201d.<\/p>\n\n\n\n

Based on the images posted on social media, the ransomware note<\/a> is in English and warns computer users that their files have bee encrypted. If they want to regain control of their files, they have to pay a ransom of $300 for decryption services. The latest reports as of this writing state that about 20 transactions have already occurred (amounting to about $4,900 based on blockchain records). But there has been no news of any successful decryptions as of the moment.<\/p>\n\n\n\n

\"New<\/span>
The Group IB Twitter account uploaded<\/a> this image of the ransom note.<\/figcaption><\/figure><\/div>\n\n\n\n

NotPetya’s\u00a0Main Target is Ukraine<\/h2>\n\n\n\n

Initial reports indicate that the majority of the attacks are happening in Ukraine. One of those greatly affected has been the Chernobyl nuclear power plant. It has switched to manual radiation monitoring services after having to shut down all of their Windows computers. The official website of the main Chernobyl plant has also been closed and there have been no reported radiation leaks. Systems at state-owned Ukrenego, Ukraine\u2019s electricity supplier, have also been compromised. But according to a spokesperson, the ransomware threat has not affected the power supply.<\/p>\n\n\n\n

Government agencies in the country weren\u2019t spared, with officials reportedly sending images of their infected computers, including Ukrainian Deputy Prime Minister Pavlo Rozenko. The deputy prime minister said the government\u2019s computer network went down. He also said the central bank reported disruption to operations at banks and firms. The municipal metro, state telecom, and Boryspil Airport in Kiev have also been affected.<\/p>\n\n\n\n

\"New<\/span><\/figure><\/div>\n\n\n\n

Several private firms\u2019 operations and systems have also been disrupted by the ransomware. Ukraine\u2019s Channel 24 posted a screenshot of the ransom note. It read, \u201cPerhaps you are busy looking for a way to recover your files, but don\u2019t waste your time. Nobody can recover your files without our decryption service.\u201d<\/p>\n\n\n\n

ATMs and point-of-sale terminals were also infected, with several people posting on social media about not being able to gas up and what appears to be stalled lines in a “Rost” supermarket.<\/p>\n\n\n\n

In general, the hack has disrupted the services and operations of airlines, banks, transportation, utilities, government, and retail in Ukraine. Despite the major impact of the virus, Ukraine has still been able to respond with some good humor in a public announcement a few hours after news of the attack broke out. The country\u2019s official Twitter account posted<\/a> a popular comic meme while requesting citizens not to panic.<\/p>\n\n\n\n

Other Countries Affected by NotPetya<\/h2>\n\n\n\n

Based on reports, Russia is another country suffering major disruptions due to the NotPetya virus. The ransomware has spread to the partially government-owned oil giant Rosneft. The company said it was facing a \u201cpowerful hacker attack\u201d. But even if its systems had suffered \u201cserious consequences\u201d, oil production was unaffected since it switched over to backup systems, according to Reuters<\/a>.<\/p>\n\n\n\n

Over at the United Kingdom, and British multinational advertising and PR company WPP has also reported that they had been targeted by the malware.<\/p>\n\n\n\n

Danish shipping conglomerate Maersk confirmed the infection of systems across multiple sites, including at their freight forwarding company, Damco. Multinationals in Spain, companies in Lithuania, and a major shipping firm in the Netherlands have also been infected by the ransomware. <\/p>\n\n\n\n

Other countries affected in Europe are France, Italy, Germany, and Poland.<\/p>\n\n\n\n

Global law firm DLA Piper has also confirmed<\/a> that several of its offices were infiltrated by hackers.<\/p>\n\n\n\n

One of the three terminals in India\u2019s largest container port, the Jawaharlal Nehru Port in Mumbai, was also affected by the attack. India-based offices of Reckitt Benckiser (owner of Lysol and Enfamil) and Beiersdorf (makers of Nivea products) reported some disruptions as well. While in Australia, the Hobart factory in Tasmania and a Cadbury factory were hit. There have also been attacks detected in some businesses across the Asia-Pacific region, but no further details have surfaced as of now.<\/p>\n\n\n\n

In the United States, a hospital in Pittsburgh and the pharmaceutical company Merck were reportedly affected by the malware attack.<\/p>\n\n\n\n

Is NotPetya\u00a0the Same as WannaCry? <\/h2>\n\n\n\n

When reports of the virus first came out, most believed it was linked to the ransomware which hit hundreds of thousands of computers in April. Researchers stated that the new malware used the same EternalBlue exploit as WannaCry<\/a>, which targeted a vulnerability in Microsoft Windows. Security experts believe this is why the virus has been able to spread so quickly.<\/p>\n\n\n\n

Other security experts claimed the hackers could have borrowed a malware code used in the previous \u201cGoldenEye\u201d and \u201cPetya\u201d ransomware attacks.<\/p>\n\n\n\n

However, it seems this latest strain of malware is even more dangerous than WannaCry<\/a> and other predecessors since cyber security specialists believe it has no kill switch. Additionally, it has some added features in the malware which allows it to infect Windows computers that have already been patched for WannaCry. Aside from that, affected PCs are unable to reboot and are unresponsive.<\/p>\n\n\n\n

Who is Responsible? <\/h2>\n\n\n\n

There is currently no report on the origins of the hack and who is responsible for it. But since the present threat has affected Ukraine\u2019s electricity service, some are speculating that it could have been Russia. The country was blamed for attacks on Ukraine\u2019s power grid in 2015 and 2016. However, Russia has denied all cyber attacks on foreign soil.<\/p>\n\n\n\n

The Seriousness of Ransomware<\/h2>\n\n\n\n

After last month\u2019s WannaCry scare, security experts and governments urged companies and consumers to update their computers with a Microsoft patch as protection from the virus. However, the quick spread of the new ransomware leaves one to assume that not too many took the malware threat seriously and\/or failed to secure their PCs. On the other hand, this can indicate that hackers are getting better<\/a> at their “job”.<\/p>\n\n\n\n

In any case, everyone is advised to take protective measures to prevent ransomware and other viruses from infecting their computers.<\/p>\n","protected":false},"excerpt":{"rendered":"

Just a month after 300,000 computers worldwide were affected by WannaCry, a new ransomware threat, called NotPetya is attacking government agencies and major private firms around the world. Emerging news show that the attack began on Tuesday, with the first confirmed reports coming from Ukraine and Russia. Throughout the day, various companies from the United Kingdom, the United States, and across Europe and Asia also reported that their systems were hit. Researchers were eyeing a link to WannaCry, but security […]<\/p>\n","protected":false},"author":1,"featured_media":9560,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[17587,17593],"tags":[],"class_list":["post-9545","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","category-staying-safe"],"acf":[],"yoast_head":"\nNew Ransomware, NotPetya, Quickly Spreading Across the Globe Just Weeks After WannaCry - The Plug - HelloTech<\/title>\n<meta name=\"description\" content=\"After 300,000 computers worldwide were affected by WannaCry, a new ransomware, NotPetya is attacking government agencies and major private firms.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"New Ransomware, NotPetya, Quickly Spreading Across the Globe Just Weeks After WannaCry - The Plug - HelloTech\" \/>\n<meta property=\"og:description\" content=\"Just a month after 300,000 computers worldwide were affected by WannaCry, a new ransomware threat, called NotPetya is attacking government agencies and\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware\" \/>\n<meta property=\"og:site_name\" content=\"The Plug - HelloTech\" \/>\n<meta property=\"article:publisher\" content=\"http:\/\/www.facebook.com\/hellotech\" \/>\n<meta property=\"article:published_time\" content=\"2017-06-29T17:54:23+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-06-12T14:07:30+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2017\/06\/notpetya-min.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"640\" \/>\n\t<meta property=\"og:image:height\" content=\"426\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@HelloTech\" \/>\n<meta name=\"twitter:site\" content=\"@HelloTech\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/dec00225dd888a509740ace5e4d9de6c\"},\"headline\":\"New Ransomware, NotPetya, Quickly Spreading Across the Globe Just Weeks After WannaCry\",\"datePublished\":\"2017-06-29T17:54:23+00:00\",\"dateModified\":\"2021-06-12T14:07:30+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware\"},\"wordCount\":1103,\"publisher\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/#organization\"},\"articleSection\":[\"News\",\"Staying Safe\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware\",\"url\":\"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware\",\"name\":\"New Ransomware, NotPetya, Quickly Spreading Across the Globe Just Weeks After WannaCry - The Plug - HelloTech\",\"isPartOf\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/#website\"},\"datePublished\":\"2017-06-29T17:54:23+00:00\",\"dateModified\":\"2021-06-12T14:07:30+00:00\",\"description\":\"After 300,000 computers worldwide were affected by WannaCry, a new ransomware, NotPetya is attacking government agencies and major private firms.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.hellotech.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"New Ransomware, NotPetya, Quickly Spreading Across the Globe Just Weeks After WannaCry\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#website\",\"url\":\"https:\/\/www.hellotech.com\/blog\/\",\"name\":\"The Plug - HelloTech\",\"description\":\"Turn to The Plug for informative tech news that you can use. \",\"publisher\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.hellotech.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#organization\",\"name\":\"HelloTech\",\"url\":\"https:\/\/www.hellotech.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2018\/11\/HT-logo-revised-final.png\",\"contentUrl\":\"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2018\/11\/HT-logo-revised-final.png\",\"width\":1000,\"height\":174,\"caption\":\"HelloTech\"},\"image\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"http:\/\/www.facebook.com\/hellotech\",\"https:\/\/twitter.com\/HelloTech\",\"http:\/\/www.instagram.com\/hello_tech\",\"https:\/\/www.youtube.com\/channel\/UCIR-fbAKRfVuAbciDr2z4nQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/dec00225dd888a509740ace5e4d9de6c\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/cbb537d18df244ad7d57a3639d94ede5cd90bf1fb742392af5731beaf11ffeb1?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/cbb537d18df244ad7d57a3639d94ede5cd90bf1fb742392af5731beaf11ffeb1?s=96&d=mm&r=g\",\"caption\":\"admin\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"New Ransomware, NotPetya, Quickly Spreading Across the Globe Just Weeks After WannaCry - The Plug - HelloTech","description":"After 300,000 computers worldwide were affected by WannaCry, a new ransomware, NotPetya is attacking government agencies and major private firms.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware","og_locale":"en_US","og_type":"article","og_title":"New Ransomware, NotPetya, Quickly Spreading Across the Globe Just Weeks After WannaCry - The Plug - HelloTech","og_description":"Just a month after 300,000 computers worldwide were affected by WannaCry, a new ransomware threat, called NotPetya is attacking government agencies and","og_url":"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware","og_site_name":"The Plug - HelloTech","article_publisher":"http:\/\/www.facebook.com\/hellotech","article_published_time":"2017-06-29T17:54:23+00:00","article_modified_time":"2021-06-12T14:07:30+00:00","og_image":[{"width":640,"height":426,"url":"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2017\/06\/notpetya-min.jpg","type":"image\/jpeg"}],"author":"admin","twitter_card":"summary_large_image","twitter_creator":"@HelloTech","twitter_site":"@HelloTech","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware#article","isPartOf":{"@id":"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware"},"author":{"name":"admin","@id":"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/dec00225dd888a509740ace5e4d9de6c"},"headline":"New Ransomware, NotPetya, Quickly Spreading Across the Globe Just Weeks After WannaCry","datePublished":"2017-06-29T17:54:23+00:00","dateModified":"2021-06-12T14:07:30+00:00","mainEntityOfPage":{"@id":"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware"},"wordCount":1103,"publisher":{"@id":"https:\/\/www.hellotech.com\/blog\/#organization"},"articleSection":["News","Staying Safe"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware","url":"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware","name":"New Ransomware, NotPetya, Quickly Spreading Across the Globe Just Weeks After WannaCry - The Plug - HelloTech","isPartOf":{"@id":"https:\/\/www.hellotech.com\/blog\/#website"},"datePublished":"2017-06-29T17:54:23+00:00","dateModified":"2021-06-12T14:07:30+00:00","description":"After 300,000 computers worldwide were affected by WannaCry, a new ransomware, NotPetya is attacking government agencies and major private firms.","breadcrumb":{"@id":"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.hellotech.com\/blog\/notpetya-ransomware"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.hellotech.com\/blog\/notpetya-ransomware#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.hellotech.com\/blog\/"},{"@type":"ListItem","position":2,"name":"New Ransomware, NotPetya, Quickly Spreading Across the Globe Just Weeks After WannaCry"}]},{"@type":"WebSite","@id":"https:\/\/www.hellotech.com\/blog\/#website","url":"https:\/\/www.hellotech.com\/blog\/","name":"The Plug - HelloTech","description":"Turn to The Plug for informative tech news that you can use. ","publisher":{"@id":"https:\/\/www.hellotech.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.hellotech.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.hellotech.com\/blog\/#organization","name":"HelloTech","url":"https:\/\/www.hellotech.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hellotech.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2018\/11\/HT-logo-revised-final.png","contentUrl":"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2018\/11\/HT-logo-revised-final.png","width":1000,"height":174,"caption":"HelloTech"},"image":{"@id":"https:\/\/www.hellotech.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["http:\/\/www.facebook.com\/hellotech","https:\/\/twitter.com\/HelloTech","http:\/\/www.instagram.com\/hello_tech","https:\/\/www.youtube.com\/channel\/UCIR-fbAKRfVuAbciDr2z4nQ"]},{"@type":"Person","@id":"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/dec00225dd888a509740ace5e4d9de6c","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/cbb537d18df244ad7d57a3639d94ede5cd90bf1fb742392af5731beaf11ffeb1?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/cbb537d18df244ad7d57a3639d94ede5cd90bf1fb742392af5731beaf11ffeb1?s=96&d=mm&r=g","caption":"admin"}}]}},"_links":{"self":[{"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/posts\/9545","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/comments?post=9545"}],"version-history":[{"count":0,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/posts\/9545\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/media\/9560"}],"wp:attachment":[{"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/media?parent=9545"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/categories?post=9545"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/tags?post=9545"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}