Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Malware & Threats

Petya Variant Goldeneye Emerges

A variant of the Petya ransomware has emerged recently, which has been renamed to Goldeneye, but shows almost no differences when compared to the original, security researchers warn.

A variant of the Petya ransomware has emerged recently, which has been renamed to Goldeneye, but shows almost no differences when compared to the original, security researchers warn.

Initially spotted in March this year, Petya became known because it didn’t encrypt user’s files, but modified the MBR (Master Boot Record) in a two-step process and denied access to the entire hard disk. A couple of months later, Petya’s authors decided to bundle the malware with a second ransomware, Mischa, which would kick in when Petya’s encryption process failed.

In July, the Petya-Mischa bundle had already inspired similar threats and was being sold as a Ransomware-as-a-Service (RaaS). While the malware’s behavior didn’t change between those updates, researchers noticed a major difference from the original modus operandi to the one employed by the latest variant using the Goldeneye name.

The ransomware is currently being distributed via resume-themed spam emails targeting enterprise users in Germany. Two attachments are included in the spam emails, one being a fake resume, while the other is an Excel spreadsheet that contains malicious macros designed to install the malware, BleepingComputer explains.

As soon as the victim enables the macros, embedded base64 strings are launched and saved into an executable file in the temp folder, which is then executed to start encrypting the files on the computer. Only after completing the encryption, the malware attempts to modify the MBR, which is the opposite of what Petya-Mischa did before, when they first attacked the MBR and only then encrypted files.

Goldeneye appends a random 8-character extension to the encrypted files, and then modifies the MBR with a custom boot loader. As soon as the encryption operation has been completed, a ransom note is displayed, but only for a short period of time, because the malware reboots the infected computer to encrypt the hard drive’s MFT (Master File Table) to deny access to files.

The ransom screen displayed by the new variant is almost identical to that used by Petya, with only one change made to it: the word “files” has been replaced with “harddisks,” Avira reveals. The text color was modified to yellow, after being red in the initial version and green after Mischa came into play. Goldeneye asks victims to pay a $1,000 ransom and directs users to a Dark Web portal that also includes a support area.

Related: Locky Variant Osiris Distributed via Excel Documents

Related: HDDCryptor Ransomware Variant Used in San Francisco Rail System Attack

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Cybercrime

CISA, NSA, and MS-ISAC issued an alert on the malicious use of RMM software to steal money from bank accounts.

Cybercrime

Chinese threat actor DragonSpark has been using the SparkRAT open source backdoor in attacks targeting East Asian organizations.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cyberwarfare

Russia-linked cyberespionage group APT29 has been observed using embassy-themed lures and the GraphicalNeutrino malware in recent attacks.

Application Security

Electric car maker Tesla is using the annual Pwn2Own hacker contest to incentivize security researchers to showcase complex exploit chains that can lead to...

Malware & Threats

Cybercrime in 2017 was a tumultuous year "full of twists and turns", with new (but old) infection methods, a major return to social engineering,...

Malware & Threats

Norway‎-based DNV said a ransomware attack on its ship management software impacted 1,000 vessels.