After monitoring this new outbreak for 24 hours, I came to the conclusion we were dealing with cyber warfare, and not ransomware. Two separate reports coming from Comae Technologies and Kaspersky Lab experts confirm this now.
NotPetya is a destructive disk wiper similar to Shamoon which has been targeting Saudi Arabia in the recent past. Note that Shamoon actually deleted files, NotPetya goes about it slightly different, it does not delete any data but simply makes it unusable by locking the files and then throwing away the key. The end result is the same.
Someone is hijacking known ransomware families and using them to attack Ukrainian computer systems. Guess who.
You never had a chance to recover your files. There are several technical indicators that NotPetya was only made to look as ransomware as a smoke screen:
It never bothers to generate a valid infection ID
The Master File Table gets overwritten and is not recoverable
The author of the original Petya also made it clear NotPetya was not his work
This has actually happened earlier. Foreshadowing the NotPetya attack, the author of the AES-NI ransomware said in May he did not create the XData ransomware, which was also used in targeted attacks against Ukraine. Furthermore, both XData and NotPetya used the same distribution vector, the update servers of a Ukrainian accounting software maker.
Catalin Cimpanu, the Security News Editor for Bleepingcomputer stated: "The consensus on NotPetya has shifted dramatically in the past 24 hours, and nobody would be wrong to say that NotPetya is on the same level with Stuxnet and BlackEnergy, two malware families used for political purposes and for their destructive effects. Evidence is clearly mounting that NotPetya is a cyber-weapon and not just some overly-aggressive ransomware."
Cybersecurity has moved from tech to a CEO and Board-level business issue
You did not sign up for this, but today it is abundantly clear that as an IT pro you are have just found yourself on the front line of 21-st century cyber war. Cybersecurity has moved from tech to a CEO and Board-level business issue. I strongly suggest you have another look at your defense-in-depth, and make sure to:
Have weapons-grade backups
Step users through new-school security awareness training.
I mean I know it all sucks and it would be awesome if all the right people got all the right info and took all the right actions. but they don't and won't. So we need to push everyone that we can to do what they can. It's just what we have to work with.
If we're talking about the same Torch, it's not malware. It has a torrent client embedded in it so that might be throwing up a flag.
Not to say it might be a phishing variant, or be compromised in another way. But the browser itself is fine (based on Chrome). Used it for a couple years before moving on.
I saw that there is a split on whether or not it is technically "malware", but that's not as much my concern. I just need to be able to positively tell the customer that it didn't come from our side (and I'm feeling pretty confident in that it did not).
And to my eyes, @BBigford, its behavior absolutely qualifies it as malware. Too much sneaky stuff going on when you use it, pop up ads all over the place, the use of the word "toolbar", etc, but I digress.
I'm curious, what percentage is sold in first world countries versus the rest of the world.
Yes, very good question. The percentages that I have seen are judged on "units shipped" not the amount of money spent on them. As Lenovo completely dominates the Chinese market, I am assuming that a major percentage of those units are sold there. I am also guessing that at least a fair percentage of their sales are very low cost devices. I know that they make Chromebooks and some entry level stuff even for the US market. They might be selling a fraction of the PCs by cost, even if leading in per unit volume.