NotPetya, not just Petya: The US National Security Agency (NSA) began using a hacking tool called EternalBlue five years ago. During that time, the agency was breaching networks using a flaw it was supposed to immediately disclose to Microsoft.
The NSA finally disclosed the vulnerability to Microsoft earlier this year, but only after exploits were stolen and then made available online. Microsoft immediately issued a “critical” patch (in March), and in May, WannaCry began to spread. A ransomware that used EternalBlue to infiltrate Windows computers. This malware managed to infect over 230,000 computers in more than 150 countries.
Yesterday we encountered NotPetya.
NotPetya is similar to the Petya ransomware, but belongs to its own classification, according to security researchers. Both used the EternalBlue exploit, but their similarities don't stop there.
NotPetya is a completely new form of ransomware that has been used since yesterday to invade the Chernobyl radiation detection system, the Kiev metro, banks, and at least one US hospital.
Kaspersky claims that at least 2,000 businesses and institutions around the world have been affected in the last 24 hours.
The latest on #petya #notpetya #ExPetr & @Securelist blog https://t.co/PK5R7sOsNO <= includes #YARA pic.twitter.com/CfuprRudf2
— Kaspersky (@kaspersky) June 27, 2017
And WannaCry, it was devastating, but it was a weak tool full of bugs created by amateurs.
NotPetya, according to experts, is not an amateur tool.
“This is big. Really big,” former NSA analyst David Kennedy told Forbes.
Unlike WannaCry, which contained a kill switch so that someone could disable it remotely, the new ransomware does not have such a feature.
The bad news is that it can infect any version of Windows, including Windows 10. It can even infect patched systems if there is an unpatched PC on the network.
The failure of the NSA and CIA to keep their tools in their hands taught a very good lesson to all those who criticized Snowden. Snowden had warned that something like this could happen.
The collection of information from services can cause damage on a global scale.
Let's not forget that NotPetya has just started….
