Petya ransomware: What we know, and the rise of Ransomware-as-a-service (RaaS)

The Petya variant
of ransomware utilizes a similar, if not somewhat modified, version of
EternalBlue exploit—as used by the Wannacry ransomware in May this year—to
spread to all active end-points on the affected network.

The Petya variant
of ransomware is different from Wannacry as Petya impacts the Master Boot
Record (MBR). Petya first reboots the computers, and then encrypts the hard
drive’s file table (MFT), which renders the MBR inoperable. From this point
forwards, it restricts access to the system by seizing information of file
names, sizes and location on the physical disk. Finally, Petya replaces the
computer’s MBR with its own code, which displays the ransom note once the
system is powered up.

There has been
report in Australia of businesses affected by the Petya ransomware, namely the Tasmanian
Cadbury chocolate factory, global law firm DLA
Piper, and the Jawaharlal
Nehru Port Trust. If the Wannacry
attacks in May this year are any indication, the Petya ransomware could
potentially be spread worldwide within the next 72 hours.

The Petya variant
of ransomware also gives rise to a new—if not unsavory—business model:
Ransomware-as-a-service (RaaS). While there is still some debate as to whether
it is a variant of Petya, GoldenEye, or a new version of Wannacry, we can be
sure that it was definitely not from the original author of the Petya variant
of ransomware. This means that hackers actually purchased the source code and
used the models to create the attack.

While the
potential payouts from ransomed victims can amount in the millions, the actual
ransomware is incredulously cheap, between US$50 to US$150, depending on per
usage or the actual ransomware source-code. The authors then offer their
ransomware on the darknet, and offer a generous portion of the paid ransom
amount to potential distributors, while the author pockets the rest.

In tests conducted
yesterday on the Petya ransomware, we can confirm that our Acronis Active
Protection™ can effectively protect users from attacks.

Anti-virus
solutions utilize signature-based detection, and targets a specific
characteristics of the virus in order to prevent it from affecting the system.
Acronis Active Protection utilizes heuristics detection, which monitors a set
of processes and procedures that ransomware and malware follow through during
an attack.

The Acronis Active Protection has been independently tested by MRG
Effitas and AV
Test, and has been proven effective against
the threat of ransomware, and is now available with Acronis
True image 2017 New Generation
for consumers, as well as Acronis Backup
12.5 for businesses.