{"id":35560,"date":"2017-06-27T13:15:49","date_gmt":"2017-06-27T20:15:49","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=35560"},"modified":"2017-07-06T17:20:42","modified_gmt":"2017-07-07T00:20:42","slug":"palo-alto-networks-protections-petya-ransomware","status":"publish","type":"post","link":"https:\/\/www2.paloaltonetworks.com\/blog\/2017\/06\/palo-alto-networks-protections-petya-ransomware\/","title":{"rendered":"Palo Alto Networks Protections for Petya Ransomware"},"content":{"rendered":"

What happened:<\/h3>\n

On June 27, 2017, the Petya ransomware began impacting multiple organizations, including government and critical infrastructure operators. The attack spreads using multiple lateral movement techniques, with similarities to the May 2017 WanaCrypt0r\/WannaCry attacks, including one method using the ETERNALBLUE<\/a> exploit tool to traverse the network via Microsoft Windows SMB protocol. Palo Alto Networks customers were automatically protected from Petya attacks with protections created, delivered and enforced across multiple elements of our Next-Generation Security Platform.\u00a0You can further watch an on-demand webcast covering threat context and preventions for Petya here<\/a>.<\/p>\n

How the attack works:<\/h3>\n

While the initial infection vector is unclear, Petya attempts to spread to other hosts using multiple lateral movement techniques, including exploiting an SMB vulnerability (CVE-2017-0144) on Microsoft Windows systems reportedly using the ETERNALBLUE exploit tool. This vulnerability was publicly disclosed by the Shadow Brokers group in April 2017, and was addressed by Microsoft in March 2017 with MS17-010<\/a>. Once a successful infection has occurred, the malware encrypts users\u2019 systems and prompts demand of a $300 payment to return access. For detailed analysis on the Petya attack playbook, please see our blog from the Unit 42 threat research team<\/a>.<\/p>\n

Preventions:<\/h3>\n

Palo Alto Networks customers are protected through our Next-Generation Security Platform, which employs a breach prevention-based approach that automatically stops threats across the attack lifecycle. Palo Alto Networks customers are protected from Petya ransomware through multiple complementary prevention controls across the platform, including:<\/p>\n