In a case of no honor among thieves, a group of attackers has found a way to hijack the Petya ransomware and use it in targeted attacks against companies without the program creators' knowledge.
A computer Trojan dubbed PetrWrap, being used in attacks against enterprise networks, installs Petya on computers and then patches it on the fly to suit its needs, according to security researchers from antivirus vendor Kaspersky Lab.
The Trojan uses programmatic methods to trick Petya to use a different encryption key than the one its original creators have embedded inside its code. This ensures that only the PetrWrap attackers can restore the affected computers to their previous state.
The Trojan also removes all mentions of Petya from the ransom message, as well as its signature red skull designed in ASCII.
Petya first appeared a year ago and immediately stood out from other ransomware programs. Instead of encrypting files directly, it replaces the hard drive's master boot record (MBR) code, which normally starts the operating system, with malicious code that encrypts the drive's master file table (MFT).
The MFT is a special file on NTFS volumes that contains information about all other files: their name, size, and mapping to hard disk sectors. The actual contents of the user's files are not encrypted, but without the MFT, the OS no longer knows where those files are located on disk.
Unlike other ransomware infections that only lock access to certain files by encrypting them, Petya locks access to the entire computer. With a corrupted MBR and MFT, the operating system will no longer start, and users will only be greeted by a ransom message on the screen when they turn on their computer.
The decision to hijack and use Petya without its authors' consent is clever because it solves several problems for the PetrWrap attackers. First, they don't have to write their own ransomware program, which is hard to get right, and they don't have to pay someone else for a ready-made solution either.
Second, because it has been around for a while, Petya has had time to mature into a well-developed piece of malware. The PetrWrap attackers use Petya version 3, the latest variant of the program, which, unlike previous versions, has no known flaws. That's because its creators have perfected their encryption implementation over time.
Creating something like Petya from scratch would not only be prone to errors but would also require knowledge of writing low-level bootloader code for the MBR.
Once inside a network, the PetrWrap attackers look for and steal administrative credentials. They then use the PsExec tool to deploy the malware to all endpoint computers and servers they can access.
There is no tool to decrypt the MFT of hard disk volumes affected by Petya, but because this malware doesn't encrypt the file contents, some data recovery tools might be able to reconstruct the files from hard disk raw data.
