Home Open Sauce Ransomware: Hackers try to sow doubts about nation-state theory

Author's Opinion

The views in this column are those of the author and do not necessarily reflect the views of iTWire.

Have your say and comment below.

Ransomware: Hackers try to sow doubts about nation-state theory

Ransomware: Hackers try to sow doubts about nation-state theory Featured

The people behind the last malware attack, which began in Europe and then spread to other regions, appear to be trying to play down the theory that the attack was masterminded by a nation state.

By making an offer via the Motherboard website, that they would decrypt files which were encrypted during an attack for 100 Bitcoin (US$250,000), the attackers have brought the narrative back to ransomware.

Security firms initially concluded that the malware used in the attack — which has been variously named Petya (nomenclature given to ransomware that already exists), NotPetya, ExPetr, Nyetya and GoldenEye — was ransomware.

They later said that it was a disk-wiper as in many cases it was wiping the master boot record of Windows computers making the machines unbootable.

But the attackers, who were contacted by Motherboard, have now attempted to create confusion by actually decrypting one file for the website, a 200k sample.

truth and lies

This, plus the 100 Bitcoin decryption offer, only means one thing: that the attackers are trying to shift the narrative from that of being a nation-state attack to one of being just run-of-the-mill ransomware, though on a much larger scale than usual.

The effort to create confusion in the minds of researchers was highlighted in this iTWire report about the findings by F-Secure.

One of its researchers, Andy Patel, was left scratching his head and asking: "At the end of the day, if someone wanted to build a 'wiper', why build an almost functional ransomware, save for a few bugs and a possibly misconfigured final package?"

Patel posed this query after he found that while the encryption-decryption code for the master boot record did not work, the code for carrying out the same function on system files was working.

Whether the attackers succeed in sowing doubt in people's minds about the nature of the attack — ransomware or a nation-state effort to destroy data — will depend on how many media outlets blindly repeat the story that was published by Motherboard without questioning the motives behind the attackers' move.


Australia is a cyber espionage hot spot.

As we automate, script and move to the cloud, more and more businesses are reliant on infrastructure that has the high potential to be exposed to risk.

It only takes one awry email to expose an accounts’ payable process, and for cyber attackers to cost a business thousands of dollars.

In the free white paper ‘6 Steps to Improve your Business Cyber Security’ you’ll learn some simple steps you should be taking to prevent devastating and malicious cyber attacks from destroying your business.

Cyber security can no longer be ignored, in this white paper you’ll learn:

· How does business security get breached?
· What can it cost to get it wrong?
· 6 actionable tips



Ransomware attacks on businesses and institutions are now the most common type of malware breach, accounting for 39% of all IT security incidents, and they are still growing.

Criminal ransomware revenues are projected to reach $11.5B by 2019.

With a few simple policies and procedures, plus some cutting-edge endpoint countermeasures, you can effectively protect your business from the ransomware menace.


Sam Varghese

website statistics

A professional journalist with decades of experience, Sam for nine years used DOS and then Windows, which led him to start experimenting with GNU/Linux in 1998. Since then he has written widely about the use of both free and open source software, and the people behind the code. His personal blog is titled Irregular Expression.


Popular News