Global cyber attack latest: What we know so far as huge cyber attack spreads across Europe

Germany’s Metro said on Tuesday its wholesale stores in the Ukraine have been hit by a cyber attack and the retailer was assessing the impact.

What the ransomware behind the cyber attack? 

Alan Woodward, a computer scientist at Surrey University, said: “It appears to be a variant of a piece of ransomware that emerged last year.

“It was updated earlier in 2017 by the criminals when certain aspects were defeated. The ransomware was called Petya and the updated version Petrwap.”

Travis Farral, director of security strategy at Anomali, said: “While initial reports have only centred on the Ukraine being hit by a new stream of ransomware known as PetrWrap, this is a global attack. 

“Just like WannaCry, organisations are locked out of their networks and a fee demanded to decrypt files, and could also be leveraging the same EternalBlue vulnerability, which attacks SMB file-sharing services. 

“Bitcoin payments are currently already at $2,000+ already. But it’s essential that victims understand that payment may not actually allow them to access their data, and may just fund hackers to commit further crimes.”

A new report by Kaspersky Lab said: “In May 2016 Kaspersky Lab discovered Petya ransomware that not only encrypts data stored on a computer, but also overwrites the hard disk drive’s master boot record (MBR), leaving infected computers unable to boot into the operating system.

“The malware is a notable example of the Ransomware-as-a-Service model, when ransomware creators offer their malicious product ‘on demand’, spreading it by multiple distributors and getting a cut of the profits. 

“In order to get their part of the profit, the Petya authors inserted certain “protection mechanisms” into their malware that do not allow the unauthorized use of Petya samples.”

Marco Cova, senior security researcher at Lastline, said: “The Petya attack looks very similar in its dynamics and techniques to the WannaCry ransomware that caused large disruption just a few weeks ago. 

“In particular, like WannaCry, it seems to rely on the EternalBlue exploit to automatically spread from one machine to another. 

“It’s still early in the infection lifecycle, but obviously, if it is confirmed that the EternalBlue is the only spreading mechanism, there will be inevitable questions about how organizations could still fall to this attack after all the publicity and support tools (patches, scanning tools, etc.) that were produced as part of the WannaCry response.”