Merck IT systems still crippled in Petya's aftermath

Four days after its networks were infected, operations are still hamstrung at the pharmaceutical giant. U.S. employees have been reduced to keeping paper records of their work.

Four days after its networks were infected, computer systems at pharmaceutical giant Merck is still hamstrung by the Petya ransomware.

The company told its 70,000 employees on Tuesday to immediately cease all interactions with company networks, to refrain from turning on or rebooting any company computers or tablets, and to not use thumb drives. As company email was completely disabled, Merck supervisors disseminated instructions down the corporate ladder via copied and pasted text messages. The company did assure employees that human resource data had not been compromised.

Petya is technically ransomware, as it encrypts users’ files and demands bitcoin to access them. But unlocking files with a purchasable key appears impossible, leading cybersecurity researchers to conclude that Petya was designed to be destructive, rather than a scheme to make money. Petya’s creators are unknown, but the fact that Ukrainian government systems and Ukrainian companies were among the first victims has prompted Ukrainian government officials to publicly blame the Russian government, though Russian companies have also been affected.

It’s unclear how Merck was infected with Petya, which partly relies Eternal Blue, the leaked tool released by the mysterious hacker group Shadow Brokers and believed to be developed by the National Security Agency. While the majority of Merck employees are in the U.S., the company has a worldwide presence, including an office in Ukraine.

Merck’s plummeting productivity is hardly unique among Petya victims, and it’s clear the ransomware has caused a significant drop in productivity around the globe. Ukrainian government workers have said they’re reduced to only working via their smartphones. And on Wednesday, a representative for Maersk, the world’s largest shipping company, said that the company had temporarily ceased taking any new orders.

Since the attack, Merck has instructed its U.S. employees, largely comprised of a sales force scattered across the country, to run a low-fi operation. Employees have been communicating with clients exclusively via telephone and in-person meetings, along with keeping a paper record of their workdays. Those who work from regional offices and the company’s New Jersey headquarters are told to refrain from connecting to company wi-fi.

As a partial fix, the company has created a makeshift temporary email server, accessible only via web browser, where employees can set up a new account to at least send and receive emails with a Merck domain via their personal computers. That doesn’t give them access to old emails, though, and other functions, like Outlook calendar, aren’t accessible. The company hopes to merge the email accounts once the original email network is restored.

The company didn’t respond to request for comment, though it did tweet a statement on Wednesday, saying that “we believe we have contained the problem.”

Employees, however, have not been given an estimated date when Merck networks will be operational again. They have, however, been instructed to monitor the company’s Twitter account, though that account hasn’t tweeted about the attack since Wednesday.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure