Concerns as New Petya Ransomware Spreads

Hackers unleashed a major cyber attack causing huge disruption to companies and governments across the globe including in the UK, US and Russia.

The ransomware appears to be a version of Petya. If it successfully infects the MBR, it will encrypt the whole drive itself. Otherwise, it encrypts all files, like Mischa, ESET later told Nigeria CommunicationsWeek.

The Petya ransomware hijacks victims' computers before encrypting their files and holding them hostage until a fee is paid.

The ransomware appears to have been spread through popular accounting software and specifically targeted at bringing down business IT systems.

The outage began in Ukraine as the country's power grid, airport, national bank and communications firms were first to report problems, before it spread rapidly throughout Europe.

Companies in the US, Germany, Norway, Russia, Denmark and France are among those to have confirmed issues so far.

Olufemi Ake, country manager, Nigeria | Ghana, ESET told Nigeria CommunicationsWeek, "Earlier today (Tuesday), we were made aware another massive global ransomware epidemic following the WannaCry and XData/AES-NI outbreaks. If you have a default install of any modern ESET product, ESET would protect against this threat. Additionally, any ESET product with network detection would protect from the SMB spreading mechanism – EternalBlue proactively.

"For spreading, it appears to be using a combination of the SMB exploit (EternalBlue) used by WannaCry for getting inside the network, then spreading through PsExec for spreading within the network. This dangerous combination may be the reason why this outbreak has spread globally and rapidly, even after the previous outbreaks have generated media headlines and hopefully most vulnerabilities have been patched", he said.

Mr. Ake confirmed it only takes one unpatched computer to get inside the network, and the malware can get administrator rights and spread to other computers.