Home Open Sauce Ransomware: Hackers try to sow doubts about nation-state theory

Author's Opinion

The views in this column are those of the author and do not necessarily reflect the views of iTWire.

Have your say and comment below.

Ransomware: Hackers try to sow doubts about nation-state theory

The people behind the last malware attack, which began in Europe and then spread to other regions, appear to be trying to play down the theory that the attack was masterminded by a nation state.

By making an offer via the Motherboard website, that they would decrypt files which were encrypted during an attack for 100 Bitcoin (US$250,000), the attackers have brought the narrative back to ransomware.

Security firms initially concluded that the malware used in the attack — which has been variously named Petya (nomenclature given to ransomware that already exists), NotPetya, ExPetr, Nyetya and GoldenEye — was ransomware.

They later said that it was a disk-wiper as in many cases it was wiping the master boot record of Windows computers making the machines unbootable.

But the attackers, who were contacted by Motherboard, have now attempted to create confusion by actually decrypting one file for the website, a 200k sample.

truth and lies

This, plus the 100 Bitcoin decryption offer, only means one thing: that the attackers are trying to shift the narrative from that of being a nation-state attack to one of being just run-of-the-mill ransomware, though on a much larger scale than usual.

The effort to create confusion in the minds of researchers was highlighted in this iTWire report about the findings by F-Secure.

One of its researchers, Andy Patel, was left scratching his head and asking: "At the end of the day, if someone wanted to build a 'wiper', why build an almost functional ransomware, save for a few bugs and a possibly misconfigured final package?"

Patel posed this query after he found that while the encryption-decryption code for the master boot record did not work, the code for carrying out the same function on system files was working.

Whether the attackers succeed in sowing doubt in people's minds about the nature of the attack — ransomware or a nation-state effort to destroy data — will depend on how many media outlets blindly repeat the story that was published by Motherboard without questioning the motives behind the attackers' move.


Did you know: 1 in 10 mobile services in Australia use an MVNO, as more consumers are turning away from the big 3 providers?

The Australian mobile landscape is changing, and you can take advantage of it.

Any business can grow its brand (and revenue) by adding mobile services to their product range.

From telcos to supermarkets, see who’s found success and learn how they did it in the free report ‘Rise of the MVNOs’.

This free report shows you how to become a successful MVNO:

· Track recent MVNO market trends
· See who’s found success with mobile
· Find out the secret to how they did it
· Learn how to launch your own MVNO service


Sam Varghese

website statistics

A professional journalist with decades of experience, Sam for nine years used DOS and then Windows, which led him to start experimenting with GNU/Linux in 1998. Since then he has written widely about the use of both free and open source software, and the people behind the code. His personal blog is titled Irregular Expression.