Video | Business Headlines | Internet | Science | Scientific Ethics | Technology | Search


New ransomware campaign known as Petya

28 Jun 2017

New ransomware campaign known as Petya

First published at 9.30am
[Original version/updates]

A new ransomware campaign known as Petya is affecting computer networks using Microsoft Windows. It was first seen affecting systems in the Ukraine, but is quickly spreading across other computer networks in Europe.

To help prevent an attack, it’s critical to ensure that all systems in a network are patched. Petya gets into unpatched versions of Windows systems (XP through 2008 R2) by exploiting a vulnerability in Microsoft's Windows SMB server. If Petya enters a network through an unpatched system, it will be able to spread to any other trusted systems in the same network, even if they have been patched.

This vulnerability exploited by Petya is known as EternalBlue. Microsoft released a patch for EternalBlue, called MS17-010, in March this year.

The ransomware encrypts not only the file system on affected computers but also the Master Boot Record (MBR) in environments where the malware is able to do so.

EternalBlue vulnerability patch MS17-010 External Link/

Read more about EternalBlue External Link/

What to do


Initial reports suggest Petya ransomware is spreading via a software vulnerability in Microsoft Windows operating systems.

• Make sure you've patched all systems in your network. Organisations using any Windows system between XP and 2008 R2 should ensure that mitigations are in place - particularly the MS17-010 Microsoft patch.

• Make sure you've backed up your system and have stored your files securely outside your network.

• If you’re not patched, consider turning the system off or disabling SMBv1 - this will stop some file sharing. These operating systems need to be either turned off or have SMBv1 disabled.

• Be careful when opening emails and clicking on links or attachments within them. They could be phishing emails that look like they've been sent by a person or organisation you know and trust.

• Ensure staff are aware of this campaign. Remind them to be vigilant about links and attachments contained in incoming emails.


If Petya enters your system, it will encrypt your files, blocking access to them and demanding you pay a ransom to get them back. This is what you’ll see if Petya is attempting to encrypt your files:


If you see this, turn your computer off, and don’t turn it on again. An IT specialist should be able to recover your files directly from the hard drive. If you turn your computer back on again and Petya encrypts them, there’s currently no way to retrieve them as the email address used in paying the ransom has been shut down.

More information

If you require more information or further support, submit a report on our website or contact us on 0800 CERTNZ.

Report an incident to CERT NZ

© Scoop Media

Business Headlines | Sci-Tech Headlines


Fund For PPP Plans: Govt Embraces Targeted Rates To Spur Urban Infrastructure

The government's latest response to the Auckland housing shortage will see central government and private sector firms invest in 'special purpose vehicles' to fund essential roading, water and drains that Auckland Council can't fund without threatening its credit rating. More>>


Superu Report: Land Regulation Drives Auckland House Prices

Land use regulation is responsible for up to 56 per cent of the cost of an average house in Auckland according to a new research report quantifying the impact of land use regulations, Finance Minister Steven Joyce says. More>>


Fletcher Whittled: Fletcher Dumps Adamson In Face Of Dissatisfaction

Fletcher Building has taken the unusual step of dumping its chief executive, Mark Adamson, as the company slashed its full-year earnings guidance and flagged an impairment against Australian assets. More>>


No More Dog Docking: New Animal Welfare Regulations Progressed

“These 46 regulations include stock transport, farm husbandry, companion and working animals, pigs, layer hens and the way animals are accounted for in research, testing and teaching.” More>>


Employment: Most Kiwifruit Contractors Breaking Law

A Labour Inspectorate operation targeting the kiwifruit industry in Bay of Plenty has found the majority of labour hire contractors are breaching their obligations as employers. More>>