The Information Technology (IT) Security Incident Response Institution Cert.lv warns of the largest ransomware campaign of all time, which is spreading rapidly on the computers of several thousand companies, institutions and private individuals around the world – several such cases have also been recorded in Latvia. This large-scale ransomware campaign is called “WannaCry” or “WannaCrypt” and it threatens several versions of the Microsoft Windows operating system.
The “WannaCry” virus executes malicious code, spreading by exploiting a vulnerability in the SMBv1 protocol (CVE-2017-0145), which can be fixed by installing the Microsoft update MS17-010 released on 14.03.2017.
The WannaCry computer virus threatens the following versions of Microsoft Windows:
- Microsoft Windows Vista SP2
- Microsoft Windows Server 2008 SP2 and R2 SP1
- Microsoft Windows 7
- Microsoft Windows 8.1
- Microsoft Windows RT 8.1
- Microsoft Windows Server 2012 and R2
- Microsoft Windows 10
- Microsoft Windows Server 2016
- Microsoft Windows XP
- Microsoft Windows Server 2003
Once the virus has infected your computer, it encrypts the files available on the computer and adds the extension .WNCRY to them, and places the files @Please_Read_Me@.txt and @WanaDecryptor@.exe in the folder with the encrypted files. The main goal of this virus is extortion, and it should be noted that the payment demand may also be received in Latvian, which in turn means that the cybercriminals have carefully prepared to target the Latvian audience as well.
It has become known that computers that do not use a firewall and whose file-sharing folders are freely accessible on the internet are particularly at risk. In this case, the virus infects the device automatically, without any additional action by the user. As soon as at least one computer on the local network is infected, the virus will spread further automatically, using the SMB protocol and UDP ports 137 and 138 and TCP ports 139 and 445.
File extensions primarily targeted by the ransomware:
- Office files ( .ppt , .doc , .docx , .xlsx , .sxi ).
- Specific office file formats ( .sxw , .odt , .hwp ).
- Archives, media files ( .zip , .rar , .tar , .bz2 , .mp4 , .mkv ).
- Emails and email databases ( .eml , .msg , .ost , .pst , .edb ).
- Database files ( .sql , .accdb , .mdb , .dbf , .odb , .myd ).
- Program source code files ( .php , .java , .cpp , .pas , .asm ).
- Encryption keys and certificates ( .key , .pfx , .pem , .p12 , .csr , .gpg , .aes ).
- Graphic design and photo editing files ( .vsd , .odg , .raw , .nef , .svg , .psd).
- Virtual machine files ( .vmx , .vmdk , .vdi )
Some recommendations to avoid the WannaCry computer virus:
- Install updates for the Windows operating system. Microsoft’s guidance for users on protecting themselves from this virus is available here;
- Pay increased attention to suspicious messages, especially in companies and institutions, where employees should be trained to recognise cybercriminals’ emails, which are often the starting point of a network intrusion;
- Use good security software. For home users we recommend Kaspersky Internet Security, and for businesses Kaspersky Endpoint Security for Business;
- Make backup copies of important data. This can also come in handy in other critical moments, for example, if your computer breaks down.
Information on the technical analysis of the virus is available here.
_______________________________________________________________________________________________________
Dear Inbox.lv users, before opening links, invoices, files, documents and other attachments in an email, consider whether these files are really addressed to you and whether they could be potentially dangerous. If you are not sure, please ask the Inbox.lv customer support service by writing to us at support@inbox.lv or call us at the toll-free number 82000.
