NotPetya Ransomware Recovery Services

Rely on Intelecis to prioritize your data recovery because downtime has a significant negative impact on business performance across all industries. Numerous businesses have benefited from the expertise of our well-equipped Ransomware Team.

What is NotPetya?

This assault mechanism was not given the moniker NotPetya by its designers. Instead, it is a moniker that cybersecurity experts gave the infection. In June 2017, NotPetya initially became visible. Analysts believed they had identified the software as a Petya ransomware system variation.

The initial Petya was released in March 2016 and underwent three iterations throughout its brief existence. First, the hacker collective that developed and maintained Petya made it available in a Ransomware-as-a-Service toolset for purchase by others. The name of such cyber gang was Janus Cybercrime Solutions, and its headquarters were in Russia. Second, at the end of 2016, the group shut down Petya, which was formerly known as Goldeneye.

How Does NotPetya Ransomware Work?

Petya takes use of the Server Message Block protocol implementation flaw CVE-2017-0144 in Microsoft. This attack first exploits the weakness before encrypting the master boot record and other files. The system is unreachable once the user receives a notification telling them to reboot it. Because of this, the operating system is unable to locate files and there is no way to decrypt the data, which turns Petya from the ransomware that it was once thought to be into a wiper.

By including a spreading mechanism similar to what we observed in WannaCry in May 2017, the new variant has significantly enhanced its capabilities. Microsoft issued a set of critical updates on March 14 to fix the underlying vulnerability in supported versions of Windows, but it’s possible that many businesses haven’t yet installed them.

What happens when a NotPetya attack is initiated?

The NotPetya ransomware’s absence of a ransomware component is its most notable characteristic. The designers never intended to provide a decryption key. For each attack, Petya creates a fresh encryption key within the processes of the downloaded ransomware application. A distinct ID is simultaneously generated for each infection. This ID has to be entered into the payment website by the victim in order for the decryption key for that attack to be retrieved from a database when the victim wishes to make a payment. This procedure was removed from the code by Sandworm, which makes it impossible for the NotPetya system to transmit a decryption key.