New Delhi June 29 (IANS) India has become the worst-hit country in the Asia Pacific and Japan (APJ) region and the seventh most affected nation globally as a new ransomware Petya hit on June 27 global cyber security firm Symantec said on Thursday.
Mumbai s Jawaharlal Nehru Port Trust (JNPT) the country s largest container port and some local manufacturing units of global companies were hit the government confirmed on Wednesday.
However according to Information Technology Minister Ravi Shankar Prasad India has largely remained insulated so far from the massive ransomware attack that started in Ukraine and Russia.
The Petya ransomware attack was clearly inspired by the WannaCry attack which received so much attention last month. The motives behind WannaCry are still unclear however it was not an effective approach to making money for its authors said Gavin O Gorman an investigator in Symantec Security Response in a post on Thursday.
The Petya ransomware was spread at least in part through updates to a Ukrainian tax accounting software.
Symantec has confirmed that MEDoc a tax and accounting software package is used for the initial insertion of Petya into corporate networks.
MEDoc is widely used in Ukraine indicating that organisations in that country were the primary target.
Once on a computer the malware attempts to spread to all machines on the network using a combination of stolen credentials and the Eternal Blue exploit.
It also attempts to connect to any computers that the infected computer has recently interacted with. However unlike WannaCry it does not attempt to connect to random IP addresses across the internet O Gorman added.
Cyber security experts believe that the new attack was caused by a variant of the Petya ransomware which was unleashed in 2016.
It differs from typical ransomware as it doesn t just encrypt files it also overwrites and encrypts the master boot record (MBR) demanding that $300 in bitcoins be paid to recover files.
--IANS
na/vt
India globally seventh most affected by Petya attack
