Home
Internet
Internet News
Petya Ransomware: India Globally Seventh Worst Affected by Cyber Attacks, Says Symantec

Petya Ransomware: India Globally Seventh Worst-Affected by Cyber-Attacks, Says Symantec

By Indo-Asian News Service | Updated: 29 June 2017 14:15 IST

Highlights

India has come out as the worst-hit Asian country affected by Petya
Petya ransomware attack hit major global companies on Tuesday
In India, Mumbai's JNPT port reported to have been compromised too

India has become the worst-hit country in the Asia Pacific and Japan (APJ) region and the seventh most affected nation globally as a new ransomware 'Petya' hit on June 27, global cyber-security firm Symantec said on Thursday.

Mumbai's Jawaharlal Nehru Port Trust (JNPT), the country's largest container port and some local manufacturing units of global companies were hit, the government confirmed on Wednesday.

However, according to Information Technology Minister Ravi Shankar Prasad, India has largely remained insulated so far from the massive ransomware attack that started in Ukraine and Russia.

"The Petya ransomware attack was clearly inspired by the WannaCry attack, which received so much attention last month. The motives behind WannaCry are still unclear, however, it was not an effective approach to making money for its authors," said Gavin O'Gorman, an investigator in Symantec Security Response, in a post on Thursday.

The Petya ransomware was spread, at least in part, through updates to a Ukrainian tax accounting software. Symantec has confirmed that MEDoc, a tax and accounting software package, is used for the initial insertion of Petya into corporate networks.

MEDoc is widely used in Ukraine, indicating that organisations in that country were the primary target.

Once on a computer, the malware attempts to spread to all machines on the network, using a combination of stolen credentials and the "Eternal Blue" exploit.

"It also attempts to connect to any computers that the infected computer has recently interacted with. However, unlike WannaCry, it does not attempt to connect to random IP addresses across the internet," O'Gorman added.

Cyber-security experts believe that the new attack was caused by a variant of the Petya ransomware which was unleashed in 2016.

It differs from typical ransomware as it doesn't just encrypt files, it also overwrites and encrypts the master boot record (MBR), demanding that $300 (roughly Rs. 20,000) in Bitcoins be paid to recover files.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.