Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

3/14/2017
05:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

New 'PetrWrap' Signals Intensified Rivalry Among Ransomware Gangs

PetrWrap modifies Petya ransomware so its authors can't control unauthorized use of their malware.

Researchers at Kaspersky Lab have discovered a new ransomware family that basically steals features from the infamous Petya ransomware.

The new PetrWrap uses Petya ransomware to encrypt its victims' data. PetrWrap's creators built a special module that modifies the original malware "on the fly," meaning Petya's creators cannot take control of it.

Experts say the PetrWrap gang's actions could be a sign of increasing competition among players in the ransomware space.

"The modification and repurposing of malware code is not a new phenomenon; exploit kits are often created and sold on the Dark Web," says Gerben Kleijn, a security analyst with Bishop Fox. "However, the blatant hijacking of another author's ransomware and replacing function calls to make it seem like a new ransomware version altogether has not been a common trend for ransomware."

Petya, which was originally discovered in May 2016, encrypts data stored on a computer and overwrites the hard disk drive's master boot record so infected PCs can't boot into the operating system.

It's a prime example of ransomware-as-a-service model where threat actors offer ransomware "on demand" to spread its use among several distributors and receive part of the profit. PetrWrap creators, however, managed to bypass payment to Petya's creators by somehow cheating the protection mechanisms put in place by Petya's authors.

Until now, ransomware authors were primarily concerned with implementing encryption correctly so users couldn't decrypt files without paying ransom. Now, authors who don't want their code modified may implement mechanisms to complicate reverse engineering and modification, leading to more advanced ransomware. Others may create code specifically for reuse by other threat actors and sell it on the Dark Web, Kleijn notes.

PetrWrap's authors found a way around these protective mechanisms. Now they can use Petya to infect machines, change the code in real time to hide which malware they're using, and avoid paying Petya's creators.

Petya has a strong cryptographic algorithm. The people behind PetrWrap use their own public and private encryption keys, which let them work without need of a key from the Petya authors to decrypt victims' machines if the ransom is paid.

This strong algorithm is likely what attracted PetrWrap's authors to exploit Petya, which has been updated after mistakes in earlier versions allowed security researchers to find ways of decrypting files. Victims' machines are now consistently encrypted when Petya attacks, meaning it was a strong malware family for PetrWrap's creators to exploit, notes Kleijn.

Anton Ivenov, senior security researcher for Anti-Ransom at Kaspersky Lab, spins the trend of threat actors targeting one another in a positive light:

"We are now seeing that threat actors are starting to devour each other and from our perspective, this is a sign of growing competition between ransomware gangs," he says in a statement.

"Theoretically, this is good, because the more time criminal actors spend on fighting and fooling each other, the less organized they will be, and the less effective their malicious campaigns will be."

What's worrisome, he continues, is PetrWrap is used in targeted attacks, which are increasingly used on enterprise victims.

More cybercriminals are launching targeted attacks on organizations with the primary goal of encrypting data. Those employing ransomware for these attacks typically seek vulnerable servers and use special frameworks to get the access they need to install ransomware throughout the network.

Kleijn says that while the discovery of PetrWrap doesn't pose a new risk to businesses, it does indicate the ransomware industry is evolving. Expect to see the rise of more ransomware variants, especially as authors begin to sell code to fellow attackers, he says.

Businesses can defend against ransomware attacks by using security software with behavior-based detection, which observes how malware operates on victim systems and detects unknown ransomware. They should also back up data, assess security of control networks, and educate employees, especially operational and engineering staff, on recent attacks.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Manchester United Suffers Cyberattack
Dark Reading Staff 11/23/2020
As 'Anywhere Work' Evolves, Security Will Be Key Challenge
Robert Lemos, Contributing Writer,  11/23/2020
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-15682
PUBLISHED: 2020-11-27
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.
CVE-2017-15683
PUBLISHED: 2020-11-27
In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.
CVE-2017-15684
PUBLISHED: 2020-11-27
Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.
CVE-2017-15685
PUBLISHED: 2020-11-27
Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.
CVE-2017-15686
PUBLISHED: 2020-11-27
Crafter CMS Crafter Studio 3.0.1 is affected by: Cross Site Scripting (XSS), which allows remote attackers to steal users’ cookies.