Petya was a malware outbreak that surfaced on June 27, 2017 and spread through the same SMBv1 flaw that WannaCry used. CISA says it behaves more like destructive malware than ransomware. It rewrites the master boot record when it gains administrator rights. Patching, network segmentation and tested backups reduce the damage.
Petya hit companies a few weeks after WannaCry and locked entire machines instead of single files. Many readers still ask whether paying the ransom could unlock them.
This guide explains how the outbreak worked and what CISA recommends. It is general information and not incident response advice.
What was the Petya Ransomware Attack?
CISA reports that a Petya variant, later called NotPetya, surfaced on June 27, 2017. It hit finance, transportation, energy, commercial facilities and healthcare organizations in several countries. See the CISA alert.
CISA also states that the malware behaves more like destructive malware than ransomware. Recovery looks unlikely even when the victim pays.
How did Petya Spread?
- SMBv1 exploits. EternalBlue and EternalRomance move the malware between PCs. WannaCry used EternalBlue as well.
- Admin tools. PsExec and WMI carry the malware to other PCs.
- Stolen credentials. CISA states that a modified Mimikatz tool steals Windows credentials in most cases.
- Software backdoor. CISA reports a backdoor in M.E.Doc, a Ukrainian tax accounting package, dating back to April 14, 2017.
What does Petya Do to a PC?
CISA states that it encrypts files with AES-128 using a dynamically generated key. When it gains administrator rights it rewrites the master boot record and locks the master file table. Then it restarts the machine.
How do You Protect a Network?
- Install the MS17-010 update dated March 14, 2017 and patch all systems.
- Disable SMBv1 and filter TCP 445, TCP 139 and UDP 137-138 at network boundaries.
- Restrict PsExec and remote WMI and limit privileged accounts.
- Use host firewalls to stop traffic between workstations and segment the network.
- Store tested backups as part of a disaster recovery plan.
CISA advises that you weigh the impact on file sharing before you filter SMB.
Should You Pay the Ransom?
No. CISA discourages payment because it funds attackers and gives no guarantee of decryption. CISA adds that the payment validation email was shut down.
For response planning see how to build a ransomware playbook. For the earlier outbreak see the WannaCry ransomware attack.
Frequently Asked Questions
What was Petya?
Petya was a malware outbreak that surfaced on June 27, 2017. CISA calls the variant NotPetya.
Is NotPetya Ransomware?
CISA states that it behaves more like destructive malware than ransomware. Recovery looks unlikely even after payment.
How did Petya Spread?
It used the SMBv1 exploits EternalBlue and EternalRomance and abused PsExec and WMI.
Does Patching Stop Petya?
Patch MS17-010 to close the EternalBlue path. CISA also advises limiting PsExec, WMI and privileged accounts.
Should I Pay a Petya Ransom?
No. CISA discourages payment because it funds attackers and gives no guarantee of decryption.
Key Takeaways
- Petya surfaced on June 27, 2017.
- It spread through SMBv1 exploits, PsExec, WMI and stolen credentials.
- It rewrites the master boot record when it gains administrator rights.
- Patching, segmentation and tested backups reduce the damage.
- Paying gives no guarantee of decryption.
Sources and References
This guide follows CISA publications.