New PetrWrap Signals Intensified Rivalry Among Ransomware Gangs

PetrWrap modifies Petya ransomware so its authors cant control unauthorized use of their malware.

Researchers at Kaspersky Lab have discovered a new ransomware family that basically steals features from the infamous Petya ransomware.
The new PetrWrap uses Petya ransomware to encrypt its victims data. PetrWraps creators built a special module that modifies the original malware on the fly, meaning Petyas creators cannot take control of it.
Experts say the PetrWrap gangs actions could be a sign of increasing competition among players in the ransomware space.
The modification and repurposing of malware code is not a new phenomenon; exploit kits are often created and sold on the Dark Web, says Gerben Kleijn, a security analyst with Bishop Fox. However, the blatant hijacking of another authors ransomware and replacing function calls to make it seem like a new ransomware version altogether has not been a common trend for ransomware.
Petya, which was originally discovered in May 2016, encrypts data stored on a computer and overwrites the hard disk drives master boot record so infected PCs cant boot into the operating system.
Its a prime example of ransomware-as-a-service model where threat actors offer ransomware on demand to spread its use among several distributors and receive part of the profit. PetrWrap creators, however, managed to bypass payment to Petyas creators by somehow cheating the protection mechanisms put in place by Petyas authors.
Until now, ransomware authors were primarily concerned with implementing encryption correctly so users couldnt decrypt files without paying ransom. Now, authors who dont want their code modified may implement mechanisms to complicate reverse engineering and modification, leading to more advanced ransomware. Others may create code specifically for reuse by other threat actors and sell it on the Dark Web, Kleijn notes.
PetrWraps authors
found a way
around these protective mechanisms. Now they can use Petya to infect machines, change the code in real time to hide which malware theyre using, and avoid paying Petyas creators.
Petya has a strong cryptographic algorithm. The people behind PetrWrap use their own public and private encryption keys, which let them work without need of a key from the Petya authors to decrypt victims machines if the ransom is paid.
This strong algorithm is likely what attracted PetrWraps authors to exploit Petya, which has been updated after mistakes in earlier versions allowed security researchers to find ways of decrypting files. Victims machines are now consistently encrypted when Petya attacks, meaning it was a strong malware family for PetrWraps creators to exploit, notes Kleijn.
Anton Ivenov, senior security researcher for Anti-Ransom at Kaspersky Lab, spins the trend of threat actors targeting one another in a positive light:
We are now seeing that threat actors are starting to devour each other and from our perspective, this is a sign of growing competition between ransomware gangs, he says in a statement.
Theoretically, this is good, because the more time criminal actors spend on fighting and fooling each other, the less organized they will be, and the less effective their malicious campaigns will be.
Whats worrisome, he continues, is PetrWrap is used in targeted attacks, which are increasingly used on enterprise victims.
More cybercriminals are launching targeted attacks on organizations with the primary goal of encrypting data. Those employing ransomware for these attacks typically seek vulnerable servers and use special frameworks to get the access they need to install ransomware throughout the network.
Kleijn says that while the discovery of PetrWrap doesnt pose a new risk to businesses, it does indicate the ransomware industry is evolving. Expect to see the rise of more ransomware variants, especially as authors begin to sell code to fellow attackers, he says.
Businesses can defend against ransomware attacks by using security software with behavior-based detection, which observes how malware operates on victim systems and detects unknown ransomware. They should also back up data, assess security of control networks, and educate employees, especially operational and engineering staff, on recent attacks.
Related Content:
60% of Businesses Mistakenly Sent out Sensitive Documents
Awareness Training Can Help Quell Ransomware Attacks
The Industrial Revolution of Application Security

Last News
▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
New PetrWrap Signals Intensified Rivalry Among Ransomware Gangs