Petya Ransomware: Sophos Assures Customers of Security

Sophos has assured its customers of adequate protection from the new Variant of Petya Ransomware, also known as Petrwrap/Petyawrap.

“Sophos is responding to a new variant of the Petya ransomware family that has affected organizations across Europe. Petya was first discovered in 2016 – it is ransomware that encrypts MFT (Master File Tree) tables and overwrites the MBR (Master Boot Record), dropping a ransom note and leaving victims unable to boot their computer, " Jitendra Bulani, ‎PR manager, Emerging Markets at Sophos said in an email to Nigeria CommunicationsWeek, adding that the new variant is particularly virulent because it uses multiple techniques to spread automatically within a company’s network once the first computer is infected.

"Sophos customers with Sophos Endpoint Protection products are protected against this new variant. Sophos Intercept X customers were proactively protected with no data encrypted, from the moment this new ransomware variant appeared.”

He said that it is necessaary to ensure systems have the latest patches, including the one in Microsoft MS17-010 bulletin.

"Consider blocking the Microsoft PsExec tool from running on users’ computers. You can block it using a product such as Sophos Endpoint Protection. A version of this tool is used as part of another technique used by the Petya variant to spread automatically; back up regularly and keep a recent backup copy off-site. There are dozens of ways other than ransomware that files can suddenly vanish, such as fire, flood, theft, a dropped laptop or even an accidental delete.

"Encrypt your backup and you won’t have to worry about the backup device falling into the wrong hands; avoid opening attachments in emails from recipients you don’t know, even if you work in HR or accounts and you use attachments a lot in your job.

"Download the free trial of Sophos Intercept X and, for home (non-business) users, register for the free Sophos Home Premium Beta, which prevents ransomware by blocking the unauthorized encryption of files and sectors on your hard disk", among other suggestions.