Was Recent Ransomware Attack Ransomware Or Cyberwarfare?

Remember that ransomware that hit the world a couple of weeks ago? No, not WannaCry. That was bad, but this one was worse. It has several names, but most probably recognize it as Petya or NotPetya. It was nasty. It started by exploiting some tax software that is widely used in Ukraine and spread like wildfire across the globe. Unlike WannaCry, there was no kill switch and also unlike WannaCry, it was even able to affect systems that were patched. Some companies remain crippled by it nearly three weeks later.

Another interesting tidbit about this one is that it does not appear the motivation for it was fueled by profit. In fact, some were finding out that even if they paid the bitcoin, they were not receiving any information on how to decrypt the data. This led researchers to do more investigation on why someone would do such a thing if there was no financial gain.

Of course all kinds of theories exist. One is that the entire thing was all done just to cause harm. Some believe it was a test just to see if it would work and that ransomware was merely a disguise for a real and targeted cyber attack. 

But by whom, some may be wondering? Well, since the initiation point was the Ukraine and against a software that is used by all companies, the most obvious answer is Russia. After all, they have had a bone to pick with Ukraine for a very long time and this is certainly one way to cause those in that country a lot of grief. The others affected by it are merely serendipitous collateral damage for whomever did it.

Of course all off the information on this is merely speculation and a lot more information will be needed to make any final charges against any one or any entity. But the fact that someone may be trying out forms of nation-state cyberwarfare is very concerning.

What does not change, regardless of any of this, is that most likely any malware that is spread like this will begin with phishing. So always stay on top of your game when it comes to potential phishing attacks. If an email is not expected, arrives from an unknown sender, and/or includes a link or attachment, it should always be met with suspicion. If you cannot determine its safety, just delete it.