NotPetya

On 27 June 2017 — the eve of Ukraine's Constitution Day — a destructive malware outbreak began spreading from Ukraine and within hours reached companies on every continent. It displayed a ransom note modeled on the 2016 "Petya" ransomware and demanded a Bitcoin payment, but researchers quickly found its disk encryption was irreversible: the malware corrupted data regardless of whether a victim paid. Because of this and its resemblance to Petya, analysts named it "NotPetya" (also called ExPetr or Diskcoder.C) to distinguish it from genuine ransomware — it was a wiper wearing ransomware's clothes.

The M.E.Doc supply-chain compromise

The outbreak began through a compromise of M.E.Doc, tax and accounting software used by most companies doing business in Ukraine. According to the security firm ESET, attackers had planted a backdoor inside M.E.Doc's software-update mechanism for at least six weeks before the attack, using it to push the malicious payload to customers' machines disguised as a routine update. ESET described the operation as "thoroughly well-planned and well-executed." On 4 July 2017, Ukraine's cyber-police seized M.E.Doc's servers after detecting further suspicious activity.

Spread and technical mechanics

Once inside a network, NotPetya combined two propagation techniques to move with unusual speed: a Mimikatz-based module harvested Windows credentials from memory and reused them via PsExec and WMIC, while the malware also exploited the EternalBlue and EternalRomance SMB vulnerabilities — the same NSA-linked exploits leaked by the Shadow Brokers in April 2017 and used weeks earlier in the WannaCry outbreak — to reach unpatched machines. On each host it overwrote the Master Boot Record and encrypted the NTFS Master File Table, leaving machines unbootable and their data unrecoverable.

Impact

Roughly 80 percent of infections were concentrated in Ukraine, where government ministries, banks, the Kyiv metro, and the radiation-monitoring system at the former Chernobyl nuclear plant were all disrupted. Because M.E.Doc was also used by multinational firms with Ukrainian subsidiaries, the malware spread globally. Shipping company A.P. Moller-Maersk, pharmaceutical firm Merck, logistics company FedEx (via its TNT Express subsidiary), Mondelez, and Saint-Gobain were among those reporting major disruption; Maersk and Merck each later disclosed roughly $200-300 million in related costs, and FedEx cited around $400 million. A February 2018 White House assessment put total global damages at "more than $10 billion," calling it "the most destructive and costly cyber-attack in history."

Attribution

On 15 February 2018, the United States, United Kingdom, and Australia issued coordinated statements attributing NotPetya to the Russian military. The White House press secretary said "the Russian military launched" the attack as "part of the Kremlin's ongoing effort to destabilize Ukraine" and warned of "international consequences." The UK's National Cyber Security Centre judged it "almost certainly" the work of the Russian military, a conclusion the Foreign Office formalized through Lord (Tariq) Ahmad. In October 2020, the US Department of Justice indicted six officers of the GRU's Unit 74455 — the group researchers call Sandworm — on charges including conspiracy and computer fraud tied to NotPetya and other attacks. These remain government and prosecutorial attributions rather than findings proven in a completed trial; no defendant has been convicted, and Russia has denied involvement.

Timeline

• 2017-04-14The Shadow Brokers leak a set of NSA-linked exploits, including EternalBlue, which NotPetya would later use for lateral movement.
• 2017-06-27NotPetya begins spreading, distributed through a compromised update of the Ukrainian accounting software M.E.Doc; Ukrainian government agencies, banks, and the Chernobyl radiation-monitoring system are disrupted, and the malware quickly spreads to multinational companies worldwide.
• 2017-07-04Ukraine's cyber-police seize servers belonging to M.E.Doc's developer after detecting further suspicious network activity.
• 2018-02-15The United States, United Kingdom, and Australia issue coordinated statements attributing the NotPetya attack to the Russian military; the White House calls it 'the most destructive and costly cyber-attack in history.'
• 2020-10-19The US Department of Justice indicts six officers of the GRU's Unit 74455 (Sandworm) on charges including conspiracy and computer fraud in connection with NotPetya and other destructive cyber operations.