'Petya' ransomware attack spreads globally, targets include Merck in US

RT
Tue, 27 Jun 2017 17:46 UTC

The US-based division of the global pharmaceutical giant Merck has been hit by the 'Petya' ransomware attack that has crippled computer systems across the world on Tuesday.

"We confirm our company's computer network was compromised today as part of global hack," Merck said in a statement on Tuesday. "Other organizations have also been affected. We are investigating the matter and will provide additional information as we learn more."

"The company is currently experiencing a hostile ransomware attack on its network systems," said an internal Merck memo quoted by the Philadelphia Inquirer. "While IT risk management and global security respond to this threat please remain calm."

Merck employees were instructed to disconnect all mobile devices from the company network and advised not to speak to reporters or post messages on social media accounts.

Computers at Merck facilities in Pennsylvania and New Jersey locked up Tuesday morning around 8am local time, according to the Inquirer.

The ransomware attack reportedly began in Ukraine, but has since spread to corporate systems across the world, affecting the Russian state oil giant Rosneft, the international shipping and energy conglomerate Maersk, and the UK-based advertising and public relations company WPP, among others.

Comment: Ukraine banks, companies and airport hit by massive hack attack, government computers offline

"We can confirm that Maersk IT systems are down across multiple sites and business units. We are currently asserting the situation," the company said.

Group IB, a Moscow-based cyber security company, said that hackers used a cryptolocker called "Petya," which blocks access to computers and displays a message demanding a $300 ransom payable in bitcoin.

The ransomware is similar in impact to "WannaCry," a code derived from the US National Security Agency (NSA) and posted online by the hacker group ShadowBrokers. A WannaCry ransomware attack shut down over 200,000 computers globally in May.

No one has claimed responsibility for this latest attack.

Reader Comments

lucidity · 2017-06-27T18:29:49Z

Is there any evidence of targeting? Or, like most malware, does it simply infect whatever it is able to infect?

sadcom · 2017-06-27T19:24:46Z

Ransomware does not infect and does not spread on its own - it only encrypts the data files on the computer and attached network drives/shares. Another software (a root kit) that infects your computer from a link in the email that you click, opening an attachment or by visiting a site that has been compromised. If could be lucky and already patched the vulnerability that they exploit - you will not even know. Or, the software will use 0-day exploit from which your computer is defenseless and even anti-virus software does not detect that activity as malicious in nature and will not stop it...

The best protection is to do backups of your data and keep it on external HDD or flash memory that is stored separately from your computer.