A vaccine, not a killswitch, has been discovered to prevent the Petya/NotPetya ransomware from infecting machines.
Researchers have yet to discover a killswitch that would prevent the spread of this week's massive ransomware outbreak, but one has found a "vaccine" that can halt the spread of the attack, reports BleepingComputer.
The rapidly spreading ransomware hit businesses, including those in critical infrastructure, across Russia, Ukraine, France, Netherlands, Spain, India, and Denmark. Some experts found similarities with the Petya malware, including its encryption of the Master Boot Record (MBR) on infected systems. Others say this malware hasn't been previously seen and call it NotPetya.
Amit Serper, a security researcher with Cybereason, discovered the ransomware operates by searching for a local file, and will exit the encryption process if the file already existed on the disk. Victims can block the ransomware from executing by creating this file on their machines.
To implement the vaccination, create a file called "perfc" in the "C:\Windows" folder and set it to read-only. Researchers call this a vaccination, not a killswitch, because it only vaccinates the machine where it's stored. A killswitch could be turned on to prevent all incidents of this ransomware.
Read more details here.
About the Author(s)
You May Also Like
Guarding the Cloud: Top 5 Cloud Security Hacks and How You Can Avoid Them
April 4, 2024Cybersecurity Strategies for Small and Med Sized Businesses
April 11, 2024Defending Against Today's Threat Landscape with MDR
April 18, 2024Securing Code in the Age of AI
April 24, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024Black Hat Asia - April 16-19 - Learn More
April 16, 2024