Security firm Symantec announced that a new variant of 'Ransom.Petya' ransomware is attacking large corporations and organizations worldwide and urged extreme caution.

Many cases of infection are being reported as a new variant of Petya ransomware began to spread on the 27th. Similar to WannaCry, which recently caused a large-scale global infection crisis, Petya ransomware is characterized by its ability to spread itself through the Eternal Blue exploit using the MS17-010 vulnerability.

Petya was first detected in 2016, and unlike typical ransomware that simply encrypts files, it is analyzed to cause greater damage by overwriting and encrypting the Master Boot Record (MBR). In the recently discovered attack, a case was confirmed in which a ransom of $300 was demanded in Bitcoin to recover files.

Petya infection message displayed on computer screen

According to a Symantec investigation, Petya is currently targeting companies in Europe as its primary targets. While it is not yet certain whether it was a targeted attack, previous variants of Petya have been used in targeted attacks against corporations.

"Petya ransomware is an example of worm propagation that adopted the method of WannaCry ransomware, which spread on a massive scale by exploiting an SMB vulnerability leaked through the hacking of the U.S. National Security Agency (NSA). It is expected that similar cybercrimes mimicking this will emerge in the future," said Yoon Kwang-taek, CTO of Symantec Korea. "Domestic companies should also update their software and apply the latest security patches to avoid damage."

Symantec products detect the Petya component as 'Ransom.Petya'. Symantec Endpoint Protection (SEP) and Norton products use EternalBlue to protect against attempts to spread Petya, and SONAR behavioral detection technology actively blocks Petya infections.