New 'PetrWrap' Signals Intensified Rivalry Among Ransomware Gangs

Researchers at Kaspersky Lab have discovered a new ransomware family that basically steals features from the infamous Petya ransomware.

The new PetrWrap uses Petya ransomware to encrypt its victims' data. PetrWrap's creators built a special module that modifies the original malware "on the fly," meaning Petya's creators cannot take control of it.

Experts say the PetrWrap gang's actions could be a sign of increasing competition among players in the ransomware space.

"The modification and repurposing of malware code is not a new phenomenon; exploit kits are often created and sold on the Dark Web," says Gerben Kleijn, a security analyst with Bishop Fox. "However, the blatant hijacking of another author's ransomware and replacing function calls to make it seem like a new ransomware version altogether has not been a common trend for ransomware."

Petya, which was originally discovered in May 2016, encrypts data stored on a computer and overwrites the hard disk drive's master boot record so infected PCs can't boot into the operating system.

It's a prime example of ransomware-as-a-service model where threat actors offer ransomware "on demand" to spread its use among several distributors and receive part of the profit. PetrWrap creators, however, managed to bypass payment to Petya's creators by somehow cheating the protection mechanisms put in place by Petya's authors.

Until now, ransomware authors were primarily concerned with implementing encryption correctly so users couldn't decrypt files without paying ransom. Now, authors who don't want their code modified may implement mechanisms to complicate reverse engineering and modification, leading to more advanced ransomware. Others may create code specifically for reuse by other threat actors and sell it on the Dark Web, Kleijn notes.

PetrWrap's authors found a way around these protective mechanisms. Now they can use Petya to infect machines, change the code in real time to hide which malware they're using, and avoid paying Petya's creators.

Petya has a strong cryptographic algorithm. The people behind PetrWrap use their own public and private encryption keys, which let them work without need of a key from the Petya authors to decrypt victims' machines if the ransom is paid.

This strong algorithm is likely what attracted PetrWrap's authors to exploit Petya, which has been updated after mistakes in earlier versions allowed security researchers to find ways of decrypting files. Victims' machines are now consistently encrypted when Petya attacks, meaning it was a strong malware family for PetrWrap's creators to exploit, notes Kleijn.

Anton Ivenov, senior security researcher for Anti-Ransom at Kaspersky Lab, spins the trend of threat actors targeting one another in a positive light:

"We are now seeing that threat actors are starting to devour each other and from our perspective, this is a sign of growing competition between ransomware gangs," he says in a statement.

"Theoretically, this is good, because the more time criminal actors spend on fighting and fooling each other, the less organized they will be, and the less effective their malicious campaigns will be."

What's worrisome, he continues, is PetrWrap is used in targeted attacks, which are increasingly used on enterprise victims.

More cybercriminals are launching targeted attacks on organizations with the primary goal of encrypting data. Those employing ransomware for these attacks typically seek vulnerable servers and use special frameworks to get the access they need to install ransomware throughout the network.

Kleijn says that while the discovery of PetrWrap doesn't pose a new risk to businesses, it does indicate the ransomware industry is evolving. Expect to see the rise of more ransomware variants, especially as authors begin to sell code to fellow attackers, he says.

Businesses can defend against ransomware attacks by using security software with behavior-based detection, which observes how malware operates on victim systems and detects unknown ransomware. They should also back up data, assess security of control networks, and educate employees, especially operational and engineering staff, on recent attacks.

Related Content: