Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

05:50 PM
Connect Directly

New 'PetrWrap' Signals Intensified Rivalry Among Ransomware Gangs

PetrWrap modifies Petya ransomware so its authors can't control unauthorized use of their malware.

Researchers at Kaspersky Lab have discovered a new ransomware family that basically steals features from the infamous Petya ransomware.

The new PetrWrap uses Petya ransomware to encrypt its victims' data. PetrWrap's creators built a special module that modifies the original malware "on the fly," meaning Petya's creators cannot take control of it.

Experts say the PetrWrap gang's actions could be a sign of increasing competition among players in the ransomware space.

"The modification and repurposing of malware code is not a new phenomenon; exploit kits are often created and sold on the Dark Web," says Gerben Kleijn, a security analyst with Bishop Fox. "However, the blatant hijacking of another author's ransomware and replacing function calls to make it seem like a new ransomware version altogether has not been a common trend for ransomware."

Petya, which was originally discovered in May 2016, encrypts data stored on a computer and overwrites the hard disk drive's master boot record so infected PCs can't boot into the operating system.

It's a prime example of ransomware-as-a-service model where threat actors offer ransomware "on demand" to spread its use among several distributors and receive part of the profit. PetrWrap creators, however, managed to bypass payment to Petya's creators by somehow cheating the protection mechanisms put in place by Petya's authors.

Until now, ransomware authors were primarily concerned with implementing encryption correctly so users couldn't decrypt files without paying ransom. Now, authors who don't want their code modified may implement mechanisms to complicate reverse engineering and modification, leading to more advanced ransomware. Others may create code specifically for reuse by other threat actors and sell it on the Dark Web, Kleijn notes.

PetrWrap's authors found a way around these protective mechanisms. Now they can use Petya to infect machines, change the code in real time to hide which malware they're using, and avoid paying Petya's creators.

Petya has a strong cryptographic algorithm. The people behind PetrWrap use their own public and private encryption keys, which let them work without need of a key from the Petya authors to decrypt victims' machines if the ransom is paid.

This strong algorithm is likely what attracted PetrWrap's authors to exploit Petya, which has been updated after mistakes in earlier versions allowed security researchers to find ways of decrypting files. Victims' machines are now consistently encrypted when Petya attacks, meaning it was a strong malware family for PetrWrap's creators to exploit, notes Kleijn.

Anton Ivenov, senior security researcher for Anti-Ransom at Kaspersky Lab, spins the trend of threat actors targeting one another in a positive light:

"We are now seeing that threat actors are starting to devour each other and from our perspective, this is a sign of growing competition between ransomware gangs," he says in a statement.

"Theoretically, this is good, because the more time criminal actors spend on fighting and fooling each other, the less organized they will be, and the less effective their malicious campaigns will be."

What's worrisome, he continues, is PetrWrap is used in targeted attacks, which are increasingly used on enterprise victims.

More cybercriminals are launching targeted attacks on organizations with the primary goal of encrypting data. Those employing ransomware for these attacks typically seek vulnerable servers and use special frameworks to get the access they need to install ransomware throughout the network.

Kleijn says that while the discovery of PetrWrap doesn't pose a new risk to businesses, it does indicate the ransomware industry is evolving. Expect to see the rise of more ransomware variants, especially as authors begin to sell code to fellow attackers, he says.

Businesses can defend against ransomware attacks by using security software with behavior-based detection, which observes how malware operates on victim systems and detects unknown ransomware. They should also back up data, assess security of control networks, and educate employees, especially operational and engineering staff, on recent attacks.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/14/2020
Lock-Pickers Face an Uncertain Future Online
Seth Rosenblatt, Contributing Writer,  8/10/2020
Hacking It as a CISO: Advice for Security Leadership
Kelly Sheridan, Staff Editor, Dark Reading,  8/10/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
7 New Cybersecurity Vulnerabilities That Could Put Your Enterprise at Risk
In this Dark Reading Tech Digest, we look at the ways security researchers and ethical hackers find critical vulnerabilities and offer insights into how you can fix them before attackers can exploit them.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-08-14
Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to anyone by sending packet data to UDP port 5000.
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-10751. Reason: This candidate is a duplicate of CVE-2020-10751. Notes: All CVE users should reference CVE-2020-10751 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidenta...
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-18270. Reason: This candidate is a duplicate of CVE-2017-18270. Notes: All CVE users should reference CVE-2017-18270 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidenta...
PUBLISHED: 2020-08-14
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
PUBLISHED: 2020-08-14
Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to obtain a long-lasting token by impersonating the server.