As far as Wikipedia has provided information, I understood, that the Petya malware was disguised as a PDF file, which the target machines were attempting to open.

Assuming this is the case, did the victims really just launched the PDF file they have received? I mean how did they receive that infected PDF file? Was it via emails, did they click on a malicious link, was it spread on the network and the internet...? I am actually asking this because I reside in the territory of it's attack and was not affected by it.


I'm assuming you meant the recent outbreak of 'Petya' that is also known as 'NotPetya', since it was based on the original 'Petya' but it is not 'Petya', hence the name 'NotPetya'

NotPetya was spread through an infected software update process for a software company in Ukraine called MeDoc, which make accounting software. NotPetya's authors exploited MeDoc's update system to create a backdoor, and then pushed their Malware through it. MeDoc is widely used (especially in Ukraine) which is why it spread pretty quickly.

The 'original' petya, most likely spread the same way many variants of ransomware do, through infected attachments on emails. An infected Word document will execute its code if the user can be tricked into clicking 'Enable Content', as this allows Word to execute the macros, which is a set of programming instructions, emmbedded into the document.

Regarding PDFs, as far as I understand (and I'm not an expert) PDfs can contain dynamic content, such as Javascript executable code, which executes when the document is opened.

The way you asked makes me think you're concerned about getting infected by a similar malware in the future. The best way to fight back against this, or any ransomware, is not to get infected in the first place, while this wasn't completely applicable in this instance, since it was an infected supplier higher up the chain. But aside from that, use antivirus, keep your software up to date (Yes I can see the irony with this advice), don't open attachments from senders you don't completely trust, check urls, double check the sender of emails (addresses can be spoofed), and don't click enable content!

If the worst comes to the worst and you get hit by ransomware, keep separate backups so you can recover, don't pay unless you really really need the data back- and be sure to check that other people who paid actually got their data back, since those who paid NotPetya, did not.

Image taken from F-Secure's CRO Mikko Hypponen

  • Actually yes, I was concerned about how so many organizations got suddenly striked whereas I, an average and everyday citizen did not. I was more thinking to use virtual machines in order to avoid being infected on the hosting machine. – Unit1 Jul 24 '17 at 6:00
  • Thats an option, of course, but it doesn't prevent you from making a mistake and opening an infected something on the host, and you'd still get everything on the VM encrypted. imo its far better to be exercise precautions to prevent any infection in the first place, and keep regular backups so you can recover if your precautions failed. – joedamarsio Jul 24 '17 at 7:36
  • Snapshots/Checkpoints exist for a reason :) Anyway since those attacks being possible on rich doc formats as well as PDF being able to execute Javascripts, I consider it's a lesson for me to learn about IT security and will serve me well. Thanks for that. On a side note I am not using an anti virus but I rely on Windows Defender as the first line of defense. I am practicing the policy of not getting infected in the first place and calculating risks appropriately (Free_ipad.exe for example or many fake download button links). – Unit1 Jul 24 '17 at 12:42
  • Good news! You are using Antivirus, Windows Defender is an Antivirus! Best of luck learning more, there's a wealth of knowledge out there. – joedamarsio Jul 24 '17 at 12:45
  • I thank you. My primary "anti-virus" however is my common sense ^^ I should consider installing malware-bytes to my machines. I heard it's pretty useful - even it's free version. – Unit1 Jul 24 '17 at 12:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.