A recent variant of Petya ransomware, known as “ExPetr” or “NotPetya” or “GoldenEye”, is spreading rapidly across the world this week. Similar to the earlier WannaCry malware, the recent attack utilizes the EternalBlue exploit against the MS17-010 vulnerability to attack unpatched Microsoft Windows-based workstations and servers.
If you’re a Zyxel ZyWALL USG user and are using Anti-Virus and Intrusion Detection and Prevention (IDP) services, please follow the steps below to guard against the attacks:
- Apply the Microsoft MS17-010 patch on your Microsoft systems, if you haven’t done yet
- Enable the Intrusion Detection and Prevention (IDP) service
When someone attempts to make use of the Microsoft MS17-010 exploit to start the attack, the IDP service is in place to prevent it from happening. If your ZyWALL USG device is running on firmware version ZLD 4.25 and make sure your IDP signature is updated to version 3.2.4.055 or above. For those with ZyWALL USG firmware ZLD 4.20 or earlier, please update to IDP signature version 3.1.4.267 or above.
- Enable the Anti-Virus/Anti-Malware service
Gateway Anti-Virus catches malware at its first point of entry, preventing it from spreading across the internal network. Make sure your Anti-Virus signature is updated to version 2.0.1.678 or above.
Fighting malware is a never-ending battle. Find out more tips here to defend your data from ransomware attacks. Zyxel advises users to contact their local service representatives if you require further information or assistance.
