NotPetya

NotPetya
Name	NotPetya
Date	June 27, 2017
Type	Wiper disguised as ransomware
Targets	Ukraine, global financial institutions, shipping companies, energy sector, manufacturing
Perpetrators	Attributed to Main Directorate (GRU) (according to several governments) and Sandworm (cybercriminal group) (alleged)
Casualties	Data destruction, operational disruption
Damages	Estimated billions in economic losses

NotPetya NotPetya was a destructive malware incident that emerged on June 27, 2017, initially affecting Ukrainian Ministry of Finance, State Treasury Service, and private institutions before spreading globally to Maersk, Merck & Co., Rosneft, and others. Analysts characterized it as a wiper masquerading as ransomware that leveraged a compromised update mechanism for M.E.Doc and later used the EternalBlue exploit and credential harvesting to propagate across Microsoft Windows. Governments including the United States Department of Homeland Security, the United Kingdom National Cyber Security Centre, and NATO-linked statements attributed the operation to actors tied to the Main Directorate (GRU) and the group known as Sandworm (cybercriminal group).

Background and origins

The outbreak occurred amid heightened tensions following the 2014 Ukrainian revolution, the Annexation of Crimea by the Russian Federation, and ongoing conflict in Donbas. Ukraine's adoption of M.E.Doc tax and accounting software connected many public and private entities to a centralized update infrastructure, which adversaries exploited much like prior compromises of supply chain attack vectors such as the CCleaner incident. Cybersecurity vendors and research labs including ESET, Symantec, Kaspersky Lab, Microsoft Security Response Center, CrowdStrike, FireEye, and Palo Alto Networks analyzed samples and linked the code reuse and operational patterns to earlier campaigns against Ukrainian targets, reminiscent of operations disclosed after the 2015 Ukrainian power grid cyberattack and campaign artifacts tied to BlackEnergy.

Infection and propagation

Initial compromise reportedly involved a poisoned update mechanism for the Ukrainian accounting package M.E.Doc. The malicious installer deployed a loader that executed a wiper payload and a credential-stealing component that captured Windows credentials and lateral movement tools. Propagation used multiple techniques: exploit of the EternalBlue SMBv1 vulnerability—previously weaponized in the WannaCry ransomware attack—use of the EternalRomance exploit framework, and legitimate administrative utilities such as PSExec and Windows Management Instrumentation (via the Windows Management Instrumentation service). The combination of a supply-chain vector, publicly known exploits, and harvested credentials enabled rapid lateral spread through corporate networks like those of Maersk, DLA Piper, and Law firms.

Technical analysis and behavior

The malware presented ransom notes and a demand for payment in Bitcoin but lacked effective recovery mechanisms; its master boot record and file encryption behavior were irreversibly destructive, aligning with characteristics of a wiper rather than conventional ransomware. Analysts from ESET, Kaspersky Lab, Symantec, Microsoft, and SentinelOne dissected its components: a dropper, a MBR-overwriting module, an encryption routine, a credential-harvesting tool, and lateral movement utilities. The payload used pseudo-ransom features such as a public key and victim ID generation, yet the implementation destroyed recovery metadata and wiped shadow copies, differentiating it from asymmetric-key ransomware families like CryptoLocker and Locky. Code overlap and toolset reuse linked elements to earlier malware used in operations attributed to Sandworm (cybercriminal group), including shared libraries and compilation timestamps consistent with prior campaigns.

Impact and damages

Operational disruptions affected Ukrainian government agencies, Boryspil International Airport, multiple banks, utilities, and corporations across Europe, North America, and Asia. International firms such as Maersk, Merck & Co., Rosneft, Danish shipping company A.P. Moller–Maersk, and Wipro reported outages, production halts, and logistics interruptions. Economic impact estimates varied, with aggregate losses assessed in the hundreds of millions to billions of dollars by affected corporations and insurers; litigations and insurance claims referenced interruptions to supply chains, manufacturing processes, and pharmaceutical production lines. The incident revived discussions about systemic cyber resilience similar to debates after the 2016 cyber incidents and prompted reviews by regulatory bodies and sectoral stakeholders including European Network and Information Security Agency-aligned entities.

Attribution and motive

Investigations by national authorities and private cybersecurity firms converged on state-linked attribution. The United States government and agencies like the FBI and NSA issued statements implicating the Main Directorate (GRU) and operational units associated with Sandworm (cybercriminal group), citing forensic similarities to prior operations targeting Ukrainian infrastructure. Motive assessments emphasized geopolitical objectives consistent with campaigns following the 2014 Crimean crisis and efforts to exert pressure during diplomatic and economic disputes; analysts contrasted destructive intent with financial extortion models, noting the strategic timing around Ukrainian national observances and governmental functions.

Response and mitigation

Incident response involved coordination among affected corporations, national CERTs such as CERT-UA, multinational coordination via NATO Cooperative Cyber Defence Centre of Excellence, and private-sector responders like Mandiant (FireEye), CrowdStrike, and Kaspersky Lab. Mitigation measures included network isolation, restoration from offline backups, patching of MS17-010 to remediate EternalBlue, disabling SMBv1, credential resets, and implementation of network segmentation and multi-factor authentication advised by the Cybersecurity and Infrastructure Security Agency and ENISA. The event influenced policy and investment in cyber defenses, prompting tabletop exercises, revised incident response playbooks at companies like Maersk and Merck & Co., and strengthened emphasis on software supply chain security illustrated later by frameworks such as Secure Software Development Lifecycle best practices.

Category:Cyberattacks