On June 27, 2017, the Petya ransomware began impacting multiple organizations, including government and critical infrastructure operators. The attack spreads using multiple lateral movement techniques, with similarities to the May 2017 WanaCrypt0r/WannaCry attacks, including one method using the ETERNALBLUE exploit tool to traverse the network via Microsoft Windows SMB protocol. Palo Alto Networks customers were automatically protected from Petya attacks with protections created, delivered and enforced across multiple elements of our Next-Generation Security Platform. You can further watch an on-demand webcast covering threat context and preventions for Petya here.
While the initial infection vector is unclear, Petya attempts to spread to other hosts using multiple lateral movement techniques, including exploiting an SMB vulnerability (CVE-2017-0144) on Microsoft Windows systems reportedly using the ETERNALBLUE exploit tool. This vulnerability was publicly disclosed by the Shadow Brokers group in April 2017, and was addressed by Microsoft in March 2017 with MS17-010. Once a successful infection has occurred, the malware encrypts users' systems and prompts demand of a $300 payment to return access. For detailed analysis on the Petya attack playbook, please see our blog from the Unit 42 threat research team.
Palo Alto Networks customers are protected through our Next-Generation Security Platform, which employs a breach prevention-based approach that automatically stops threats across the attack lifecycle. Palo Alto Networks customers are protected from Petya ransomware through multiple complementary prevention controls across the platform, including:
NOTE: We are continuously monitoring the Petya situation and will update this post with additional details on protections as they arise.
For best practices on preventing ransomware with the Palo Alto Networks Next-Generation Security Platform, please refer to our Knowledge Base article. We strongly recommend that all Windows users ensure they have the latest patches made available by Microsoft installed, including versions of software that have reached end-of-life support. For the latest on the Petya attack playbook, please see the Unit 42 post. Join our on-demand webcast covering the threat context and preventions for Petya here.
June 27, 2017 – 8:00 PM PT
June 28, 2017 – 1:15 PM PT
Added details on MFA and segmentation