Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

05:50 PM
Connect Directly

New 'PetrWrap' Signals Intensified Rivalry Among Ransomware Gangs

PetrWrap modifies Petya ransomware so its authors can't control unauthorized use of their malware.

Researchers at Kaspersky Lab have discovered a new ransomware family that basically steals features from the infamous Petya ransomware.

The new PetrWrap uses Petya ransomware to encrypt its victims' data. PetrWrap's creators built a special module that modifies the original malware "on the fly," meaning Petya's creators cannot take control of it.

Experts say the PetrWrap gang's actions could be a sign of increasing competition among players in the ransomware space.

"The modification and repurposing of malware code is not a new phenomenon; exploit kits are often created and sold on the Dark Web," says Gerben Kleijn, a security analyst with Bishop Fox. "However, the blatant hijacking of another author's ransomware and replacing function calls to make it seem like a new ransomware version altogether has not been a common trend for ransomware."

Petya, which was originally discovered in May 2016, encrypts data stored on a computer and overwrites the hard disk drive's master boot record so infected PCs can't boot into the operating system.

It's a prime example of ransomware-as-a-service model where threat actors offer ransomware "on demand" to spread its use among several distributors and receive part of the profit. PetrWrap creators, however, managed to bypass payment to Petya's creators by somehow cheating the protection mechanisms put in place by Petya's authors.

Until now, ransomware authors were primarily concerned with implementing encryption correctly so users couldn't decrypt files without paying ransom. Now, authors who don't want their code modified may implement mechanisms to complicate reverse engineering and modification, leading to more advanced ransomware. Others may create code specifically for reuse by other threat actors and sell it on the Dark Web, Kleijn notes.

PetrWrap's authors found a way around these protective mechanisms. Now they can use Petya to infect machines, change the code in real time to hide which malware they're using, and avoid paying Petya's creators.

Petya has a strong cryptographic algorithm. The people behind PetrWrap use their own public and private encryption keys, which let them work without need of a key from the Petya authors to decrypt victims' machines if the ransom is paid.

This strong algorithm is likely what attracted PetrWrap's authors to exploit Petya, which has been updated after mistakes in earlier versions allowed security researchers to find ways of decrypting files. Victims' machines are now consistently encrypted when Petya attacks, meaning it was a strong malware family for PetrWrap's creators to exploit, notes Kleijn.

Anton Ivenov, senior security researcher for Anti-Ransom at Kaspersky Lab, spins the trend of threat actors targeting one another in a positive light:

"We are now seeing that threat actors are starting to devour each other and from our perspective, this is a sign of growing competition between ransomware gangs," he says in a statement.

"Theoretically, this is good, because the more time criminal actors spend on fighting and fooling each other, the less organized they will be, and the less effective their malicious campaigns will be."

What's worrisome, he continues, is PetrWrap is used in targeted attacks, which are increasingly used on enterprise victims.

More cybercriminals are launching targeted attacks on organizations with the primary goal of encrypting data. Those employing ransomware for these attacks typically seek vulnerable servers and use special frameworks to get the access they need to install ransomware throughout the network.

Kleijn says that while the discovery of PetrWrap doesn't pose a new risk to businesses, it does indicate the ransomware industry is evolving. Expect to see the rise of more ransomware variants, especially as authors begin to sell code to fellow attackers, he says.

Businesses can defend against ransomware attacks by using security software with behavior-based detection, which observes how malware operates on victim systems and detects unknown ransomware. They should also back up data, assess security of control networks, and educate employees, especially operational and engineering staff, on recent attacks.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-21
White Shark System (WSS) 1.3.2 is vulnerable to unauthorized access via user_edit_password.php, remote attackers can modify the password of any user.
PUBLISHED: 2021-06-21
White Shark System (WSS) 1.3.2 is vulnerable to sensitive information disclosure via default_task_add.php, remote attackers can exploit the vulnerability to create a task.
PUBLISHED: 2021-06-21
White Shark System (WSS) 1.3.2 is vulnerable to CSRF. Attackers can use the user_edit_password.php file to modify the user password.
PUBLISHED: 2021-06-20
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This c...
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.