I'm wondering whether to call the ransomware creators Petya with the flip flops of the year, or the brilliant business sharks. What to say, so far, cybercriminals have earned relatively little in this action, because only about 4 BTCs have already been extracted from the wallet used to collect tribute from the victims. During the affair, the hope of recovery (even after the ransom was sent) died. But there is a new hope ...
Because cybercriminals now want 100 bitcoins. And who is now the whore? I do not know, because in this step is a lot of controversy. Ransomware creators give incomplete evidence that they can decrypt the contents of the victim disks, and I do not expect them to be willing to pay up to 100 bitcoins for a universal, private decryption key. Especially since the "trust" of cybercriminals was already severely damaged by the fact that it was unlikely that data recovery would be possible, and Petya was called "wiper".
Recall, Petya is a ransomware / wiper, the source of which was an update server belonging to ME Doc., Which was used by cybercriminals to spread the threat to much of the world. Not only Ukrainian companies where the said entity is resident, but also Polish, German, American and others were affected. In Paris, for example, this has led to the paralysis of some institutions and important national companies (the situation is already fortunate enough, as our informant claims - thank you!). Soon after the attack was revealed, it turned out that Pety's victims were not able to recover data even after paying the ransom. This, among other things, caused the victims very reluctantly to pay money to the wallet of criminals, which further affected the very small "earnings" of the creators of Petya.
That's why I do not think they're going to get anything
100 bitcoins? And in life. The attack scale is too small to be able to think of the success of such an operation at all. What could have been done about getting the affected Petya infrastructures, was probably already done, and few will pay for the "dump" that does not have to be successful. It is too risky that money will be literally drowned in the mud. And who did not do backups, this is just ... trumpet. There are also strong suspicions that cybercriminals do not have a key at all to decrypt all data (except the bootsector). Despite the cybercriminal evidence of having private keys, there is absolutely no certainty that such a method would work a hundred percent. Therefore, caution is recommended in this regard.
What not to say - it went poorly. It is worthwhile to keep in mind the security of our computers, because this is certainly not the last such attack and we are confident that cybercriminals are constantly learning. And probably, they are also looking for methods to extract the most money from home businesses / consumers.
__
Photo from PIxabay.com