Petya is a family of encrypting ransomware that was first discovered in 2016. The malware targets Microsoft Windows-based systems, infecting the master boot record to execute a payload that encrypts a hard drive's file system table and prevents Windows from booting. It subsequently demands that the user make a payment in Bitcoin in order to regain access to the system.
Variants of Petya were first seen in March 2016, which propagated via infected e-mail attachments. In June 2017, a new variant of Petya was used for a global cyberattack, primarily targeting Ukraine. The new variant propagates via the EternalBlue exploit, which is generally believed to have been developed by the U.S. National Security Agency (NSA), and was used earlier in the year by the WannaCry ransomware. Kaspersky Lab referred to this new version as NotPetya to disambiguate it from the 2016 variants, due to these differences in operation. In addition, although it purports to be ransomware, this variant was modified so that it is unable to actually revert its own changes.
Petya utilizes a payload that infects the computer's master boot record (MBR), overwriting the Windows bootloader, and then triggering a restart. On the next startup, the payload is executed, which encrypts the Master File Table of the NTFS file system, and then displays the ransom message demanding a payment made in Bitcoin. During this process, text purportedly output by chkdsk, Windows' file system scanner, is displayed on-screen, suggesting that the hard drive's sectors are being repaired. The original payload required the user to grant it administrative privileges; one variant of Petya was bundled with an alternate payload known as Mischa, which is used if Petya fails to install. Mischa is a more conventional ransomware payload that encrypts user documents, as well as executable files, and does not require administrative privileges to execute. The earlier versions of Petya disguised its payload as a PDF file, attached to an e-mail. United States Computer Emergency Response Team (US-CERT) and National Cybersecurity and Communications Integration Center (NCCIC) released Malware Initial Findings Report (MIFR) about Petya on 30th June 2017.