A new ransomware called “Petya” has attacked several websites belonging to major companies. In the preceding months, the WannaCry attack wreaked havoc on more than 300,000 computers worldwide; Petya is believed to be connected to the same type of hacking tools as WannaCry and shares similar propagation vectors.
Petya has already taken thousands of computers hostage, impacting companies and their infrastructures from Ukraine to the United States and India . This affected the Ukrainian international airport , multinational shipping, legal and advertising firms, and led to the shutdown of radiation monitoring systems at the Chernobyl nuclear facility , demonstrating the significant global impact of this ransomware on critical infrastructure and essential services.
Global reach and impact of Petya
Numerous companies worldwide have been affected by this ransomware attack , which targets computers running Windows and typically demands a ransom in Bitcoin to attempt to regain access. The most affected countries included Ukraine, Russia, the United Kingdom, and India , although incidents were also reported in Spain and various regions of North America, South America, and Asia.
Security experts identified variants related to Petya (also referred to as Petrwrap ), while companies such as Kaspersky and other vendors identified a variant called NotPetya , considered by many specialists to be a pseudo-ransomware whose main objective is to cause harm and not necessarily to raise funds.
In the corporate sector, Petya affected large advertising groups , infrastructure companies , energy firms , pharmaceutical companies , as well as government offices and public administrations. The true cost is not limited to the ransom payment: it includes data loss or theft , prolonged business disruption, reputational damage, and technical and legal costs. In numerous incidents, the ransom payment system was rendered unusable or no decryption key was provided, reinforcing the hypothesis that in many cases the purpose was to destroy data and create instability.
Response from international organizations and law enforcement
Europol was unable to provide operational data related to the attack in its early stages; spokesperson Tine Hollevoet indicated they were trying to “get a full picture of the attack” by working with industry and law enforcement partners. Petya “is a demonstration of how cybercrime can evolve and grow, and once again, it is a reminder of the business and importance of cybersecurity , ” said Europol Executive Director Rob Wainwright.
In addition to Europol, Incident Response teams from multiple vendors (such as Check Point, Cisco, and others) detected variants of Petya spreading laterally within corporate networks . Many reports agree that the attack began with particular force in Ukraine, causing massive disruptions to critical infrastructure before spreading to the rest of Europe and other continents.
How Petya works and why it's so destructive
Petya is especially harmful because, unlike ransomware that encrypts files one by one, it can lock the entire hard drive . Many variants encrypt the Master Boot Record (MBR) and critical sectors of the disk, and display a message simulating a "file system repair" while actually encrypting the computer.
Unlike WannaCry, the Petya attack does not include a kill switch , according to Europol and industry analysis, making it difficult to disable once it has spread. In some cases, the malware waits for about an hour after infection before restarting the system and displaying the encryption warning, during which time it can continue spreading across the network.
The U.S. Computer Emergency Response Team (US-CERT) and other response centers began receiving numerous reports of infections and observed that this variant encrypts Windows registry entries and exploits vulnerabilities in the SMB messaging service. These flaws allow unpatched systems to be compromised even if they have basic security measures in place.
The file identified as RAMSON_PETYA.SMA includes different variants and infection vectors, some of which were also used in the WannaCry attack . The propagation techniques combine the SMBv1 exploit “EternalBlue ,” remote administration tools such as PsExec for lateral movement, and phishing campaigns with malicious attachments or links.
Prevention strategies: what to do before, during and after an attack
The best protection against Petya is a comprehensive preventative strategy . Experts recommend measures in three phases: before the attack, during the infestation, and after the incident, combining technical controls with human factor management.
Before the attack: maintain regular and verified backups through restoration drills; apply patches and updates to operating systems and applications; disable insecure protocols such as SMBv1 when possible; deploy threat prevention solutions and provide cybersecurity training for users.
During the attack: disconnect affected equipment from the network to contain the spread, notify the authorities and response teams, assess the scope using threat intelligence, and coordinate the response with specialized legal and technical support.
Following containment: conduct a thorough security assessment , clean backdoors and persistent artifacts, perform a forensic analysis of the chain of events, and reinforce user awareness . Implementing security architectures that prioritize prevention and network segmentation can significantly reduce the impact of future incidents.
The Petya attack and its variants demonstrate that ransomware has gone from being a marginal problem to a strategic threat to businesses, governments, and citizens. Learning from these attacks and implementing proactive measures is the only way to mitigate the impact of future outbreaks.