Maarg Manthan · Topic 14.31

Ransomware Threats (Locky, Petya, WannaCry)

Science & Technology › IT, Telecommunications and Computers · Topic 14.31

Ransomware is malicious software that blocks access to a computer or encrypts its files and demands a ransom, usually in cryptocurrency, to restore access. Locky, seen from February 2016, spread through email attachments and encrypted files, adding the extension .locky. WannaCry, which struck on 12 May 2017, hit hundreds of thousands of computers in about 150 countries by exploiting a Windows flaw called EternalBlue in the SMB protocol; it was slowed by a kill switch domain found by a security researcher. Petya and the more destructive NotPetya of June 2017 locked the master boot record and spread in Ukraine and across the world. In India, attacks include the November 2022 ransomware attack on AIIMS Delhi, and CERT-In issues advisories.

5 min read · UPSC Prelims · Science & Technology · IT, Telecommunications and Computers

At a Glance

Locky 2016, email attachments
WannaCry 12 May 2017, EternalBlue
Petya June 2017
Indian case AIIMS Delhi, 2022
Agency CERT-In
Exam link UPSC Prelims, Science & Technology: IT, Telecommunications and Computers

Where Does It Fit?

This topic follows the account of Project Brainwave and Sagar Vani. It returns to cyber security and describes the best known ransomware attacks, which link with encryption, cybercrime and the Indian cyber agencies. Previous topic: Project Brainwave and Sagar Vani System. Next topic: Digital Terrestrial Television Transmission System.

What Are the Well-Known Ransomware Attacks?

Ransomware	Features
Locky	Appeared in February 2016. Spread by spam emails with infected documents. Encrypted files and asked for bitcoin
WannaCry	Began on 12 May 2017. A worm that used the EternalBlue exploit for a Windows SMB vulnerability, reportedly developed by the US National Security Agency and leaked by a group called Shadow Brokers. It hit hospitals in the United Kingdom, companies and systems in India
Kill switch	A researcher registered an unregistered web domain that the malware checked, which stopped its spread
Petya	First seen in 2016. It encrypts the master file table or boot record, so the computer cannot start
NotPetya	Struck in June 2017, mainly Ukraine, using EternalBlue and other methods. It acted as a destructive wiper, since files could not be recovered even after payment
Ryuk and REvil	Later gangs that attack large organisations in big game hunting and sell ransomware as a service
Double extortion	Attackers steal data before encrypting it and threaten to publish it

How Does Ransomware Spread and How Can It Be Prevented?

Phishing emails: infected attachments or links are the most common way in
Software flaws: unpatched systems, as in WannaCry
Remote desktop: weak passwords on remote access
Prevention: regular patching, offline backups, strong passwords and multi-factor authentication, email filtering, and staff training
Response: isolate infected machines, restore from backups, report the incident to CERT-In and the police
Ransom payment: agencies advise against paying, as it does not guarantee recovery and funds crime
CERT-In rules: incidents must be reported within six hours under the 2022 directions
Indian cases: WannaCry affected systems in several Indian states, and in November 2022 AIIMS Delhi servers were hit, disrupting services for days

What Else Should You Remember?

Malware types: virus, worm, trojan, spyware, adware, ransomware and rootkit are different forms of malicious software
Worm and virus: a worm spreads by itself over networks, while a virus needs a host file
Trojan: malware disguised as useful software
Bitcoin and anonymity: cryptocurrency makes ransom payments hard to trace, as in Blockchain and Cryptocurrency
Ransomware as a service: developers rent their tools to affiliates
Critical sectors: hospitals, power companies and ports are targeted as downtime is costly
Colonial Pipeline: a 2021 ransomware attack on a United States fuel pipeline caused shortages
Shadow Brokers: a group that leaked tools allegedly from the NSA in 2016 and 2017
Patch management: Microsoft had issued a patch before WannaCry, but many systems were not updated
Old systems: outdated operating systems such as Windows XP stay at risk
Backups: offline and tested copies are the best defence
Cyber insurance: a growing market that covers ransomware losses
Law: extortion by ransomware is punishable under the Information Technology Act and criminal law, as in Cyber Law in India
International cooperation: agencies share information and take down servers
CERT-In advisories: regular alerts and the Cyber Swachhta Kendra help users, as in Encryption and Cybersecurity
Hospital case: AIIMS Delhi shifted to manual work for days, which showed the need for backups and segmented networks
Zero trust: a security approach where no user or device is trusted by default
Reporting channels: victims can report on the national cybercrime portal and the helpline 1930, and organisations report to CERT-In
Decryptor tools: for some old strains, security firms and police have released free tools to unlock files, so victims should check before paying
Insider and supply chain: attackers also enter through suppliers and software updates, so vendors need checks
Network segmentation: splitting a network into zones limits how far a worm can spread

Why Does It Matter for the Exam?

Years: Locky 2016, WannaCry and NotPetya 2017
Key terms: EternalBlue, kill switch, bitcoin
Indian cases: AIIMS Delhi, 2022
Current affairs link: new attacks on hospitals and CERT-In advisories
Common errors: calling WannaCry a virus and not a worm or saying NotPetya recovered files on payment

As an analytical point, most ransomware succeeds because of unpatched systems and weak human habits, not because of unstoppable technology. Prevention through backups, patching and training costs far less than recovery.

Why Is This Topic Important?

Cases Locky to NotPetya
Method Phishing and flaws
Defence Backups

What Came Next?

The next topic covers the digital terrestrial television transmission system. Next topic: Digital Terrestrial Television Transmission System.

Key People and Terms

Ransomware Malware demanding payment
Worm Self spreading malware
EternalBlue Windows SMB exploit
Kill switch Switch to halt malware
Wiper Malware that destroys data
Patch Software fix

Exam Corner

Points to Remember

WannaCry: 12 May 2017, about 150 countries.
Locky: 2016.
NotPetya: June 2017.
AIIMS Delhi attack: November 2022.
Six hour reporting to CERT-In.

Do Not Confuse With

WannaCry and NotPetya Ransom worm versus destructive wiper
Virus and worm Needs host file versus self spreading
Ransomware and spyware Locks data versus spies

Memory Hook

Locky by mail, WannaCry by EternalBlue, NotPetya wipes; patch, back up, report.

Mains Angle

Questions ask for names, years and prevention. These points help.

Threat Scale
Causes Weak hygiene
Response Institutions

A Question You May Face

An original practice question, not a past paper question.

“What is ransomware? Discuss the major ransomware attacks and the measures to protect critical infrastructure.”

How to Answer

Define Ransomware.
Cases WannaCry, NotPetya.
Causes Patching.
Measures Backups, reporting.

GS Relevance

Prelims: types of malware, ransomware examples and years, prevention. GS Paper 3: cyber security, internal security.

Frequently Asked Questions

What is ransomware?

Ransomware is a type of malicious software that locks a computer or encrypts its data and then demands a ransom, usually in cryptocurrency, in return for access. It spreads through phishing emails, software flaws and weak remote access, and targets individuals, companies, hospitals and governments.

What was the WannaCry attack?

WannaCry was a ransomware worm that began on 12 May 2017 and infected hundreds of thousands of computers in about 150 countries, including hospitals in the United Kingdom. It used the EternalBlue exploit for a flaw in Windows file sharing. A security researcher stopped its spread by registering a domain that acted as a kill switch.

What is the difference between Petya and NotPetya?

Petya, first seen in 2016, encrypts the boot area of a computer for ransom. NotPetya, which hit mainly Ukraine in June 2017, looked like Petya but was designed to destroy data, since victims could not recover files even after paying. It spread using EternalBlue and other tools.

How can ransomware be prevented?

Organisations can prevent ransomware by installing security patches promptly, keeping tested offline backups, using strong passwords with multi-factor authentication, filtering email, limiting user privileges, and training staff to spot phishing. If an attack occurs, they should isolate the systems, restore from backups and report to CERT-In.

Which Indian institution was hit by ransomware in 2022?

In November 2022 the servers of the All India Institute of Medical Sciences in New Delhi were hit by a ransomware attack, which disrupted services such as appointments and records for several days and forced staff to work manually. The incident was investigated by Indian cyber agencies.

PYQ Practice — Statement Analysis

1 WannaCry used the EternalBlue exploit.

True

On 12 May 2017.

2 NotPetya allowed recovery of files after payment.

False

It acted as a wiper.

3 A computer worm needs a host file to spread.