The master key for the original version of the Petya Ransomware is now available online, allowing victims who were infected with the malicious software to recover their files.
But wait, Petya is not NotPetya.We should not confuse the original Petya Ransomware with the latest devastating NotPetya (also known as Petya, ExPetr or Eternal Petya) that wreaked havoc around the world last month, massively targeting multiple government and non-governmental organizations in Ukraine and other parts of Europe.
The original Petya ransomware, (the code on which NotPetya was based), has three main variants, which have infected multiple systems around the world. The malware's creator, named Janus, emerged after the massive attacks caused by NotPetya, offering to help recover victims' files.
Although his efforts proved fruitless, as it turned out that NotPetya was actually a wiper disguised as ransomware, which did not encrypt, but destroyed victims' data, Janus eventually made the Petya decryption key available to victims of previous attacks.
According to security researchers, victims infected with previous variants of Petya ransomware, including Red Petya (first version), Green Petya (second version), as well as earlier versions (such as GoldenEye), can recover their encrypted files using this master key.
The published #Petya master key works for all versions including #GoldenEye pic.twitter.com/tTRLZ9kMnb
— Anton Ivanov (@antonivanovm) July 6, 2017
The authenticity of the master key was verified also by the independent security researcher, Hasherezade.
“Thanks to the master key that was released, all users who have kept the encrypted files from the relevant versions of Petya, now have the opportunity to retrieve their data back”, reports.
Even though the first two versions of Petya were cracked last year, the private key released by Janus is the fastest and most reliable way to decrypt the affected files, even for victims who have been infected with the third version of Petya, which had not been cracked.
Janus created the GoldenEye software in 2016 and offered several variants of it as Ransomware-as-a-Service (RaaS), allowing anyone to launch ransomware attacks with a single click.
