Subject: Alert - Guidance Concerning "Petya Ransomware"
From: "Microsoft" <[email-masked]>
To: <[email-masked]>
Date: Mon, 03 Jul 2017 02:10:07 -0600
List-Id: <115720_5137597.xt.local>

What is the purpose of this alert?

This alert is to provide you with guidance
concerning the ransomware issue being discussed broadly in the press starting
on Tuesday, June 27, 2017, and causing a large volume of customer
inquiries.  This ransomware is being
described by the press and security researchers as “Petya Ransomware.”

Overview

Microsoft’s
antivirus software detects and protects against this ransomware. Our initial
analysis found that the ransomware uses multiple techniques to spread,
including two which were addressed by a security update (MS17-010) previously
provided for all platforms from Windows XP to Windows 10. 

As a general
precaution, customers should exercise caution when opening unknown files. We
are continuing to investigate and will take appropriate action to protect customers..

Malware Detection

Windows Defender, System
Center Endpoint Protection, and Forefront Endpoint Protection detect this
threat family as 
https://www.microsoft.com/en-us/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/Petya?wt.mc_id=AID553982_EML_5137597 
Ransom:Win32/Petya .
Ensure you have a definition version equal to or later than:

	- Threat
 definition version: 1.247.197.0
	- Version created
 on: 12:04:25 PM : Tuesday, June 27 2017
	- Last Update:
 12:04:25 PM : Tuesday, June 27 2017
In addition, the free Microsoft Safety Scanner 
https://www.microsoft.com/security/scanner/en-us/default.aspx?wt.mc_id=AID553982_EML_5137597 
http://www.microsoft.com/security/scanner/ 
is designed to detect this threat as well as many others.

Those with a solution from an antivirus provider other than
Microsoft should check with that company.

Recommendations

Three specific steps
customers can take to mitigate against new ransomware:  

	1. Ensure you have
 the latest security updates installed
	2. Ensure you have
 the latest AV Signatures from your preferred AV vendor
	3. Do not open
 email/attachments from unknown/untrusted sources
Note: 
these are good security defense-in-depth recommendations that may
prevent being infected by this ransomware, but these steps alone do not
ensure against infection. 

Additional Resources

	- The Microsoft
 Security Tech Center: 
https://technet.microsoft.com/en-us/security/default?wt.mc_id=AID553982_EML_5137597 
https://technet.microsoft.com/en-us/security/default 
	- The Microsoft
 Security Update Guide: 
https://portal.msrc.microsoft.com/en-us/?wt.mc_id=AID553982_EML_5137597 
http://aka.ms/securityupdateguide 
More Information

When new information is
available that we can share, we will send a new security alert. 

Regarding Information Consistency

We strive to provide you with accurate information in static (this
mail) and dynamic (web-based) content. Microsoft’s security content posted to
the web is occasionally updated to reflect late-breaking information. If this
results in an inconsistency between the information here and the information in
Microsoft’s web-based security content, the information in Microsoft’s
web-based security content is authoritative.

https://blogs.technet.microsoft.com/mmpc/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/?wt.mc_id=AID553982_EML_5137597 
https://blogs.technet.microsoft.com/mmpc/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

If you have any questions regarding this alert, please contact
your Technical Account Manager (TAM)/Service Delivery Manager (SDM).

Thank you,

Team Microsoft

This message from Microsoft is an important part of a program, service, or product that you or your company purchased or participate in. 

Microsoft respects your privacy. Please refer our 
https://go.microsoft.com/fwlink/?LinkId=248681 
Privacy Statement .

Microsoft Corporation (India) Pvt. Ltd.
Level 10, Tower C, Epitome, Building No. 5, DLF Cyber City, Phase 3,

Gurgaon, Haryana 122 002 INDIA