New Ransomware Hits Companies and Organizations Worldwide

Another ransomware attack is affecting companies and organizations all around the world this week. This one has hit major companies in several countries including Russia, Britain, Ukraine, Denmark, and the United States at a minimum, as well as some other types of organizations. It does not appear to be discriminating based on sector either. It’s hit shipping, oil & gas, advertising, and pharmaceutical to name a few. This piece of ransomware is demanding about $300 in Bitcoin to release files held hostage.

Security analysts and experts are not quite sure what ransomware it is, but some are speculating that it is some form of Petya that’s doing the damage. Some are even calling it the worst worm or virus to ever hit. It has affected, to the best of anyone's knowledge at this time, about 80 companies and netted the thieves about $8,000 at time of writing.  If it is released, it will lock the computer, can destroy the files, and prevent the computer from being turned on again. 

But wait! Even if the ransom is paid, there is no guarantee that the files will be unlocked. In fact, the email address that the criminals used to communicate to victims was blocked by the email provider based in Germany. So, don't bother paying it. And that should be any person's or organization's policy. Doing this only encourages this more. Instead, make regular backups of your important files so they can be quickly restored if necessary.

There is still little known for certain about this. It just started making its way around the globe. While some believe it was likely started with a phishing email message that made its way past email filtering and anti-malware tools, others believe it was a result of an infected update for a Ukrainian tax collection software product that is believed to help prevent tax fraud in that country. 

What has been determined is that it takes advantage of the same vulnerability in unpatched Windows machines as WannaCry does. 

If you are a home user, update your Windows operating system with the patches released in April 2017. Also make sure your anti-malware software is updated and run a scan. In addition, if you connect to a corporate network via VPN, don't do that at least for a few days. Verify with your IT department that it is OK to do this first. This is because the analysts are finding with this worm that if it manages to make its way onto a corporate network at all, it will start perusing for administrative access. If it gets it, it will infect all the machines it can. Then, it will likely find its way to your home computer as well. 

If you are a corporate or other network administrator, ensure all systems are patched as well to protect against this. In addition, do system backups to ensure that if it does make its way into the network, a data restore can occur and important files are not lost forever. While there is more protection if the systems are patched, unfortunately with this one, it has been infecting patched systems as well. 

One analyst claimed to find a kill switch for this one and it was backed up by other experts. If you are an administrator, researcher Amit Serper with Cyberreason found that you can create a file in c:windows called "perfect" with no extension, it won't execute.

Likely more victims will appear over the next days and weeks, similarly to what happened when WannaCry burst into the scene last month. In the meantime, since it is not clear yet as to how it spreads, patch systems, don't connect to corporate networks with VPN for a few days, and use extreme caution when reading email messages. Avoid clicking links or attachments that are from unknown senders or that are not expected. If you cannot be 100% sure, it’s best to just delete the message without taking any action.