Computer systems around the world have been hit with a new ransomware malware called Goldeneye, a variant of Petya ransomware. Its targets are governments and businesses; infecting computers and files to lock out users and demanding $300 in Bitcoin to regain access.
Upon infecting a system the malware forces the targeted computer to restart so the victim can see the ransom note without any further delay.
The malware was discovered by security researchers at Bitdefender who are also keeping an eye on the ongoing attack and according to researcher Bogdan Botezatu “Just like Petya, it is particularly dangerous because it doesn’t only encrypt files, it also encrypts the hard drive as well.”
“GoldenEye /Petya operators have already received 13 payments in almost two hours. That is $3.5K USD worth in digital currency.”
Bitdefender and Symantec, both cyber security giants, have confirmed that Goldeneye leverages EternalBlue exploit to spread from one computer to another. The EternalBlue exploit was also used during WannaCry ransomware attack in which more than 200,000 computers were infected worldwide.
Symantec analysts have confirmed #Petya #ransomware, like #WannaCry, is using #EternalBlue exploit to spread
— Threat Intelligence (@threatintel) June 27, 2017
Another thing common between WannaCry and GoldenEye/Petya is that both malware only target Windows operating systems.
According to DailyMail, the first target of GoldenEye ransomware was Ukraine when its power grid, national bank, supermarkets, airport and telecom firms reported that their IT systems have been affected.
A Tweet from Ukrainian Deputy Prime Minister Rozenko Pavlo shows a picture of a computer system revealing that computer systems of government have been infected.
After Europe, the IT system of pharmaceutical giant Merck Sharp and Dohme in the US were reportedly infected.
UPDATE 15:00 CEST pic.twitter.com/L5pBYvNQd3
— Maersk (@Maersk) June 27, 2017
Furthermore, WPP, a UK-based ad agency also reported that its IT system was affected and the staff was asked not to use the Internet. The reports also suggest that firms and businesses in Russia, Norway, Denmark, France, Spain, and India are also under attack.
A massive hacker attack has hit the servers of the Company. We hope it has no relation to the ongoing court procedures.
— Rosneft (@RosneftEN) June 27, 2017
Sigurdur Stefnisson, vice president of threat research at Cyren said that:
“Less than three hours ago, Cyren detected a variant of the Petya ransomware. Cyren researchers identified affected users in numerous countries, including India, UK, and many others. The company anticipates this will become a widespread threat with victims emerging in all corners of the globe.”
Vishal Gupta, CEO of Seclore commented on the issue and said that:
“The rate at which these ransomware attacks are being developed, and subsequently spreading, is worrisome, but unfortunately not surprising. While there is a lot of speculation of who is behind this attack, what is most concerning is the type of institutions that are being impacted, including financial systems, airports and energy companies. When these networks are hit, the stakes are much higher, moving well beyond a nuisance. It isn’t an exaggeration to say that these attacks could have life and death consequences. As ransomware attacks continue to dominate the headlines, my hope is that companies begin to take a step back and make cybersecurity their top priority. Even simple measures like increased training, more communication around cyber security best practices, implementing data-centric security policies and ensuring updates are made can make all the difference.”
At of now, it is unclear who is behind the attack. However, we are keeping eye on the attack and this article will be updated soon. Stay tuned.
DDoS attacks are increasing, calculate the cost and probability of a DDoS attack on your business with this DDoS Downtime Cost Calculator.