{"id":7308,"date":"2022-09-11T12:17:14","date_gmt":"2022-09-11T04:17:14","guid":{"rendered":"https:\/\/x-phy.com\/?p=7308"},"modified":"2025-10-02T08:17:38","modified_gmt":"2025-10-02T08:17:38","slug":"notpetya-ransomware-cyber-attack-pfizer-covid19-vaccine-data","status":"publish","type":"post","link":"https:\/\/x-phy.com\/notpetya-ransomware-cyber-attack-pfizer-covid19-vaccine-data\/","title":{"rendered":"NotPetya Ransomware – Cyber-Attack on Pfizer for COVID-19 Vaccine Data"},"content":{"rendered":"

According to Yonhap News Agency, South Korea\u2019s National Intelligence Service (NIS) accuses that North Korea launched a cyber-attack on Pfizer, using\u00a0NotPetya ransomware<\/a>, targeting information about the COVID-19 vaccine they developed in partnership with BioNTech. With a surge in the number of COVID-19 infections, there is increased pressure on drug-makers to develop the associated vaccine in large quantities. Employees of these firms have to work harder than before, and for longer hours, a factor that exposes the firms to cyber-attacks<\/a> as cyber security<\/a> measures falls to the bottom of priority lists among employees.<\/p>\n

Technical Analysis of the NOTPETYA Ransomware Attack<\/h3>\n

Even though Pfizer has not released details of the attack, experts liken it to the notorious NotPetya, a malware associated with the 2017 Merck & Co attack. After invading a system, NotPetya ransomware launches a series of activities including dropping files<\/a>, self-propagation, privilege checking, process hashing,\u00a0credential theft<\/a>, system shutdown, and anti-forensics processes. These activities enable attackers to perform their intended operations on the target without detection.<\/p>\n

How NotPetya RANSOMWARE Compromises the Target<\/h3>\n

1: File Dropping
\n<\/em><\/strong>When NotPetya is launched, it drops various files including Ransomware DLL (located at C:windowsperfc.dat), Ransomware splash and warning files, Credential theft module ( written as .temp file in the temp directory), and writes the contents of its resource to C:Windowsdllhost.dat. The replacement makes it possible to execute processes on other systems.<\/p>\n

2. Process hashing and Privilege Checks<\/strong><\/em>
\nAfter dropping the files, the malware is launched as DLL using rundll32.exe and starts a subroutine that hashes every process to check whether Kaspersky, Notion Security, or Symantec processes are running on the system while at the same time attempts to gain viable levels of privilege.<\/a><\/p>\n

3. Credential Theft<\/strong><\/em>
\nThe malware decompresses either 0x1 or 0x2 resource, depending on the OS, and writes the resulting content in a .temp file located in the %TEMP% folder. It sets up a CNG provider which looks for wdigest.dll and lsass.exe modules responsible for digesting authentication security package and component respectively. At this point, the Local Security Authority (LSA) responsible for managing security package and enforcing security policies is compromised. The file then extracts credentials and transmits them to NotPetya through the named pipe.<\/p>\n

4. Anti-forensics<\/strong><\/em>
\nAfter execution, the malware deletes the file contents to ensure that they cannot be recovered through disk forensics. It then loads itself in the memory and deletes itself from the disk.<\/p>\n

\"notpetya
How NotPetya Compromises the Target<\/figcaption><\/figure>\n

X-PHY Protection Method<\/h3>\n

Detecting the Malicious Activity<\/em><\/p>\n

The first instruction of NotPetya ransomware<\/a> involves dropping files and adjusting privileges. Guardian Pro-X and Security Scout features within the X-Guard Threat Lock<\/a> use AI at the firmware level<\/a> to monitor the instructions sent to the target. The module mirrors the instructions sent to the target addresses by the host as well as the content of all the LBAs.<\/p>\n

The trained neural network uses the mirrored instructions and contents to determine whether the activity is malicious or not. This is achieved by comparing read\/write\/overwrite access requested by the stager against the average read\/write\/overwrite access indicated in the master boot records, master file tables, boot sectors, parameter blocks of file systems associated with the operating systems, or the secondary storage operations.<\/p>\n

The first instruction by NotPetya is to drop various files and writes the contents of its resource to C:Windowsdllhost.dat. Security Scout features will classify these activities as malicious since they intent to compromise the device. Upon detecting the malicious intent of file dropping and file replacement by the malware, the X-Factor Encryption lock<\/a> feature will trigger data lockdown to prevent malicious access to data.<\/p>\n

\"notpetya
Detection of Malicious Activity<\/figcaption><\/figure>\n

Prevention of Malicious Cloning<\/em><\/p>\n

When it is determined that there is an attempt to\u00a0illegally drop and replace files<\/a>, the X-Factor Encryption lock feature responds by triggering data lockdown<\/a>\u00a0to prevent the attacker from accessing data and activates the Keycode2-factor immediately. X-PHY enters safe mode and asks for a password to complete the 2-factor authentication. At this point, multiple unique keys must be provided to gain access to data. Otherwise, data remains locked preventing malicious theft of credentials, keeping data safe.<\/p>\n

\"notpetya<\/p>\n","protected":false},"excerpt":{"rendered":"

According to Yonhap News Agency, South Korea\u2019s National Intelligence Service (NIS) accuses that North Korea launched a cyber-attack on Pfizer, using\u00a0NotPetya ransomware, targeting information about the COVID-19 vaccine they developed […]<\/p>\n","protected":false},"author":2,"featured_media":7345,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","inline_featured_image":false,"footnotes":""},"categories":[12],"tags":[],"class_list":["post-7308","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-use-cases"],"_links":{"self":[{"href":"https:\/\/x-phy.com\/wp-json\/wp\/v2\/posts\/7308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/x-phy.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/x-phy.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/x-phy.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/x-phy.com\/wp-json\/wp\/v2\/comments?post=7308"}],"version-history":[{"count":1,"href":"https:\/\/x-phy.com\/wp-json\/wp\/v2\/posts\/7308\/revisions"}],"predecessor-version":[{"id":109797,"href":"https:\/\/x-phy.com\/wp-json\/wp\/v2\/posts\/7308\/revisions\/109797"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/x-phy.com\/wp-json\/wp\/v2\/media\/7345"}],"wp:attachment":[{"href":"https:\/\/x-phy.com\/wp-json\/wp\/v2\/media?parent=7308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/x-phy.com\/wp-json\/wp\/v2\/categories?post=7308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/x-phy.com\/wp-json\/wp\/v2\/tags?post=7308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}