[User1999]

Yeah, I was so confused as to why they were using a posteo email adress haha.

So, they're just fucking stupid or what? RIP, this ransomware is fucking retarded.

I never even heard of posteo before this. Are they like a gmail for Germany?

Either way the results of this could be much more horrific than wannacry due to the fact no one now can decrypt their files. A huge shipping company and good amount of atms have been hit.

This is like a situation where do you let the email stay on your service to give people the ability to decrypt their files or not?

[DigitalHighAss]

This is like a situation where do you let the email stay on your service to give people the ability to decrypt their files or not?

Allowing the attackers to keep that email will only encourage others to use that service again. Its a smart move to block them. In all reality there is no proof that paying the ransom would do anything either. They could just take the money and run. I just looked up the bitcoin address and they have about $10,000 so far. No money moved out of that address.

[Xphile]

Allowing the attackers to keep that email will only encourage others to use that service again. Its a smart move to block them. In all reality there is no proof that paying the ransom would do anything either. They could just take the money and run. I just looked up the bitcoin address and they have about $10,000 so far. No money moved out of that address.

They appear to be getting some rather funny transactions though:

[gdz$]

Jesus christ, not like this

[jamdoughnut]

This is a bit of a strange one to be fair. Did you see the kill-switch? Seems a little simplistic in design. Word of the twitter verse is that it started off with a poisoned update to a financial software company (me-doc). Thing is the update came out like the day before it all kicked off. Either that's some next level development or that update was really poorly written.

Either way super interesting.

---

All those people that paid won't be getting their files back either. The company that the email is associated with shut down the email.

https://posteo.de/blog/info-zur-ransomwa...g-gesperrt

Google translate shows



At noon today we learned that Ransomware blackmail is currently providing a posteo address as a contact option.
Our abuse team checked this immediately - and the mailbox immediately blocked. We do not tolerate any misuse of our platform: The intermittent blocking of abused mailboxes is a normal procedure of providers in such cases. At the time of the blocking, there was no reporting on the Ransomware.

https://mobile.twitter.com/GossiTheDog/s...9015072769

The fact that the mail provider locked the entire account, denying them access to user decryption requests... Bit of a dick move really.

[dismayed]

Here is the Malware analyst if anyone wants to look at it

https://malwr.com/analysis/N2EwM2RjY2RkM...Y1YWE5NDA/

[n31ght0]

So they just spreading by email? if so it's very easy to avoid this stuff. no worries even i use win 7

[thesharp]

This is only the start I'm afraid they'll be a lot more to come with more zero day releases from shadow brokers premium customers.

[Numinous]

You can prevent your system from Petya ransomware - https://goo.gl/A9QKmW (With 3 Methods)

[veeeeeeee4]

This is cool, lets all use a type riter.

[henixzer]

So, does any one know from where(are they getting through shady downloads?) these people are getting infected by petya and wannacry?

[AmericanExpress]

So, does any one know from where(are they getting through shady downloads?) these people are getting infected by petya and wannacry?

Malware authors tend to spread malicious software through e-mails, download websites, drive-by-downloads/exploits, etc. It pretty much evolves around user-interaction of some sort for someone to become infected and the attacker attempting to social engineer the victim is a big part to play in people becoming infected (increases chances of the victim allowing a UAC alert or even downloading and running the attachment in the first place).

If people were careful about how they behave online (e.g. while handling downloads and dealing with e-mails from untrusted senders) then there would be a let loss infections world-wide.

It doesn't take much for someone to stay clean without any Anti-Virus protection just by thinking before they do things.

[Xphile]

So, does any one know from where(are they getting through shady downloads?) these people are getting infected by petya and wannacry?

They both exploit the SMBv1 flaw that made DoublePulsar (the NSA tool leaked by the Shadow Brokers) so dangerous. After the Ransomware creates a foothold on one unpatched server, it will spread across the local network via PSEXEC and WMIC.

Basically, unpatched web-facing servers are the main cause of infections here.

Hope this helped. 🤝

[MeanGene69]

Petya was pushed out through hijacked software updates via M.E. Docs which is an accounting software most prevalent in Ukraine.

I would suspect this is not the first time the company's servers have pushed out malware. Can anyone source this?

[Cacao]

would be interesting to see what happens next