A hacker or a group of hackers behind the Petya virus, for the first time since the attack began to act. It is reported by Ain. Ua with reference to Motherboard.

The unknown ones devastated the bitcoin purse, where by this time $ 10,000 was accumulated (initially the virus extorted for decrypting files for $ 300, but those who paid no keys).

The amount was transferred to another wallet. After some time, the same group transferred small sums to the wallets of the sites Pastebin and DeepPaste - these sites are often used by hackers for ads, because the same DeepPaste, for example, is only available via Tor.

Then the unknown, acting on behalf of the creators of the virus, posted an appeal to all victims, which extorts for decrypting files (but not boot disks) of 100 bitcoins. At the time of writing at the rate of 100 bitcoins cost about $ 256 thousand. The publication notes that the message does not specify a purse, but there is a link to the chat in a darknet where users can contact the hacker (or hackers) to contact.

The publication was contacted in chatrum with one of the alleged authors of Petya and quotes his words, according to which the amount is so high, since the key is suitable for "decrypting all computers". Then the journalist Motherboard offered to decipher one file as a test. The publication transmitted one of the encrypted files to the hackers, but at the time of writing the news did not receive a response.

The French expert on infosafety, the head of Comae Technologies Matt Suish believes that hackers simply "troll journalists".

In his opinion, they just want to confuse the public by convincing everyone that Petya is still a crypto virus, not a virus-wiper (whose goal is to destroy information). The expert himself is sure of the opposite.

Recall that the Ukrainian cyberpolicy does not believe that the purpose of the most massive hacker attack on Ukrainian state and private companies was extortion. Analyzing the incidents, they found that Petya was just a cover, in fact, the attackers collected EDRPOU codes of victim companies.