There have been several large-scale ransomware campaigns over the last several months. On October 24, 2017, a widescale ransomware campaign affecting organizations across eastern Europe and Russia has been detected.

This appears to have some similarities to Nyetya in that it is also based on Petya ransomware.

Major portions of the code appear to have been rewritten. The distribution does not appear to have the sophistication of the supply chain attacks we have seen recently.

The malware then uses RunDLL32.exe to execute the malware and continue the malicious operations.

For more information you can visit our partner – Cisco Talos’ – site.