A week in security (June 26 – July 02)

Last week, we offered our readers tips on how to detect phishing attempts, gave an overview of Google's Be Internet Awesome campaign, supplemented an ongoing series on adware, and introduced the Malwarebytes Endpoint Protection to those who aren't already in the know. We also pushed out a number ...

From BlackEnergy to ExPetr

Much has been written about the recent ExPetr/NotPetya/Nyetya/Petya outbreak - you can read our findings here:Schroedinger's Petya and ExPetr is a wiper, not ransomware. As in the case of Wannacry, attribution is very difficult and finding links with previously known malware is challenging. In th...

Thousands of Security Experts Work Together to Collectively Combat Petya / NotPetya Ransomware Attack

On Tuesday, Carbon Black’s community of security experts began working together with Carbon Black Threat Research to rapidly analyze the new ransomware family that was hitting organizations from Russia to Britain. More than 100 customers and partners communicated IOCs as the attack hit. “I heard...

June 30, 2017 – Morning Cyber Coffee Headlines – “Victor Hugo” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! June 30, 2017 - Headlines Carbon Black in the News: Carbon Black Seizes The...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

Exploring the crypt: Analysis of the WannaCrypt ransomware SMB exploit propagation

Note: Read our latest comprehensive report on ransomware: Ransomware 1H 2017 review: Global outbreaks reinforce the value of security hygiene. On May 12, there was a major outbreak of WannaCrypt ransomware. WannaCrypt directly borrowed exploit code from the ETERNALBLUE exploit and the DoublePulsa...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of June 26, 2017

The late 70s/early 80s American television show Three’s Company was one of my favorite shows growing up. The central theme of the show revolved around the lives of three roommates. Each episode usually involved a misunderstanding, then chaos would ensue. In the end, everything would turn out okay...

On This Week's NotPetya, ExPetr Outbreak

Mike Mimoso and Chris Brook discuss this week’s ExPetr global ransomware outbreak, how it was distributed, the wiper aspect, and similarities to 2016’s Petya ransomware. Download: ThreatpostNewsWrapJune302017.mp3 Music by Chris Gonsalves Show notes: ExPetr Called a Wiper Attack, Not Ransomware Ne...

Windows 10 platform resilience against the Petya ransomware attack

Note: Read our latest comprehensive report on ransomware: Ransomware 1H 2017 review: Global outbreaks reinforce the value of security hygiene. The Petya ransomware attack on June 27, 2017 which we analyzed in-depth in this blog may have been perceived as an outbreak worse than last month's...

Windows 10 to Get Built-in Protection Against Most Ransomware Attacks

Ransomware Ransomware Everywhere Not a Single Place to Hide! But, Microsoft has a simple solution to this problem to protect millions of its users against most ransomware attacks. Two massive ransomware attacks — WannaCry and Petya also known as NotPetya — in a month have caused chaos and...

Petya the Great and why *they* don’t patch vulnerabilities

I really like this. Just imagine. Quiet, routine, everyday Vulnerability Management process in organizations: scanning-patching, scanning-patching, scanning-patching… And then. Suddenly! PEEETYYA!!! And at very same moment everything changes. People from different companies start to communicate...

EternalPetya and the lost Salsa20 key

We have recently been facing a huge outbreak of a new Petya-like malware armed with an infector similar to WannaCry. The research is still in progress, and the full report will be published soon. In this post, we will focus on some new important aspects of the current malware. The low-level attac...

June 29, 2017 – Morning Cyber Coffee Headlines – “Massachusetts” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! June 29, 2017 - Headlines Carbon Black in the News: How the U.S. can defend its...

Original Author of Petya Ransomware is Back & He Wants to Help NotPetya Victims

The author of original Petya ransomware is back. After 6 months of silence, the author of the now infamous Petya ransomware appeared today on Twitter to help victims unlock their files encrypted by a new version of Petya, also known as NotPetya. "We're back having a look in NotPetya," tweeted...

Carbon Black Threat Research Technical Analysis: Petya / NotPetya Ransomware

On June 27, public announcements were made about a large-scale campaign of ransomware attacks across Europe. The ransomware impacted notable industries such as Maersk, the world’s largest container shipping company. The initial infection vector appears to be the exploitation of a Ukrainian tax...

ExPetr/Petya/NotPetya is a Wiper, Not Ransomware

After an analysis of the encryption routine of the malware used in the Petya/ExPetr attacks, we have thought that the threat actor cannot decrypt victims' disk, even if a payment was made. This supports the theory that this malware campaign was not designed as a ransomware attack for financial...

The Law of Unintended Outbreak – Who Is at Risk from Petya?

Hot on the heels of the global WannaCry outbreak in May, yesterday saw a wave of what looked like copycat malware sweeping the globe again. However, on closer inspection there may more to this than meets the eye, more than a simple new variant of an already established ransomware borrowing...

'Little Hope' to Recover Data Lost to Petya Ransomware

Join Kaspersky Lab and Comae Technologies Thursday June 29, 2017 at 10 a.m. Eastern time for a webinar “The Inside Story of the Petya/ExPetr Ransomware.” Click here to attend. Fewer than 50 ExPetr/Petya ransomware victims have paid approximately $10,200 in Bitcoin so far in the hopes of unlocking...

Solution Corner: Malwarebytes Endpoint Protection

We’ve been busy here at Malwarebytes with several product announcements recently. Malwarebytes Incident Response was released in late April, providing threat detection and remediation via our new cloud-based platform. Right on its heels, leveraging the same platform is Malwarebytes Endpoint...

Partner Perspectives: Using Cb Response to Mitigate ETERNALBLUE

Editor's Note: This post originally appeared on redcanary.com In case you’ve been under a rock, there’s a wee problem with ransomware, fueled by the public release of a handful of high quality access exploit and persistence backdoor utilities. Most recently, these have manifested in the form of t...