Full Report
Group-IB has identified the ransomware that has infected energy, telecommunications and financial companies
Analysis Summary
# Incident Report: Analysis of the "PetrWrap" (Petya) Ransomware Outbreak
## Executive Summary
Group-IB has identified a sophisticated ransomware campaign targeting energy, telecommunications, and financial sectors, utilizing a modified version of Petya known as PetrWrap. The attack leverages critical vulnerabilities (EternalBlue) and credential theft to propagate across networks, resulting in widespread data encryption and operational disruption. The campaign is notably linked to the Cobalt hacker group, who utilize this ransomware to mask targeted attacks on financial infrastructure.
## Incident Details
- **Discovery Date:** June 27, 2017 (Outbreak identified)
- **Incident Date:** Malware compiled June 18, 2017; Active campaign late June 2017
- **Affected Organization:** Multiple undisclosed entities
- **Sector:** Energy, Telecommunications, Financial Institutions
- **Geography:** Global (with significant activity in Ukraine and Russia)
## Timeline of Events
### Initial Access
- **Date/Time:** June 2017
- **Vector:** Exploitation of Microsoft vulnerabilities and potential compromised software updates.
- **Details:** The attack utilized the EternalBlue (MS17-010) exploit and CVE-2017-0199 to gain initial entry into corporate networks.
### Lateral Movement
- The malware moves through the network by extracting administrative credentials using tools like Mimikatz or via LSA dumps, allowing it to spread across workstations and servers once a single entry point is established.
### Data Exfiltration/Impact
- **Impact:** The malware encrypts the Master Boot Record (MBR) and files on the system, demanding a ransom for decryption. In financial sectors, it is used as a smokescreen to hide targeted theft from ATM control systems and SWIFT gateways.
### Detection & Response
- **Detection:** Group-IB’s Managed XDR and Threat Intelligence systems identified the outbreak and provided IOCs to customers.
- **Response:** Analysts identified that the malware was compiled on June 18 and linked its deployment to the Cobalt group.
## Attack Methodology
- **Initial Access:** Exploitation of CVE-2017-0199 and MS17-010 (EternalBlue).
- **Persistence:** Modification of the Master Boot Record (MBR).
- **Privilege Escalation:** Use of Mimikatz and LSA dump techniques to acquire administrative rights.
- **Defense Evasion:** Use of PetrWrap to mask Cobalt group activities; attempting to hide traces of targeted financial theft.
- **Credential Access:** Extraction of WDigest credentials and Local Admin passwords.
- **Lateral Movement:** Propagation via SMB vulnerabilities (EternalBlue) and administrative shares using stolen credentials.
- **Impact:** Data encryption and system lockout via MBR corruption.
## Impact Assessment
- **Financial:** High; targeting SWIFT, payment gateways, and ATM processing, plus ransom demands.
- **Data Breach:** High volume of data encrypted; potential data loss as there is no evidence that paying the ransom results in restoration.
- **Operational:** Severe; total shutdown of IT infrastructure in infected energy and telecom firms.
- **Reputational:** Significant public impact due to the scale of service disruptions.
## Indicators of Compromise
- **File Indicators:**
- Perfc.dat (Note: Not a universal killswitch, as filenames may change).
- Modified MBR bootloader.
- **Behavioral Indicators:**
- Unauthorized SMB traffic on ports 139 and 445.
- Presence of credential-dumping tools in memory.
## Response Actions
- **Containment:** Isolate infected workstations from the corporate LAN; disable SMBv1.
- **Eradication:** Deployment of patches KB2871997 and MS17-010.
- **Recovery:** Restoration of systems from offline or cloud backups (recommended over paying the ransom).
## Lessons Learned
- **Patch Management:** The failure to apply critical patches months after release (MS17-010) was the primary driver of propagation.
- **Credential Hygiene:** The overuse of local administrator accounts and identical passwords across workstations facilitated rapid lateral movement.
- **False Killswitches:** Relying on specific filenames (like `perfc.dat`) for protection is insufficient, as attackers can easily recompile malware with different parameters.
## Recommendations
- **Patching:** Ensure all systems are patched for MS17-010 and CVE-2017-0199 immediately.
- **Hardening:** Disable SMBv1 and set `UseLogonCredential` to `0` in the registry to prevent WDigest credential theft.
- **Access Control:** Implement the Principle of Least Privilege (PoLP) and revoke unnecessary administrative accounts.
- **Zero Trust:** Implement a Zero Trust architecture and conduct regular security awareness training.
- **Backup:** Maintain regular, air-gapped backups (offline/cloud) to ensure recovery without negotiating with threat actors.