The Demon NotPetya, the False Blackmailer

Legend

On 27 June 2017 it set out from a tampered update of the Ukrainian accounting software M.E.Doc and spread with EternalBlue, EternalRomance and stolen credentials. It posed as ransomware but wiped data beyond recovery. It caused about $10 billion in damage worldwide and was attributed to Russian military intelligence.

Exorcism

Cast it out by segmenting the network and limiting lateral movement, since it spread on its own. SMB patches, reduced privileges and recovery from offline backups make the difference.

Technical record

Also known as: ExPetr, Nyetya, Petrwrap
Circle: Circle IV · Destroyers (wipers) · Circle I · Worms · Circle V · State espionage
First seen: 2017
Status: Dormant
Weapons (exploited CVEs): Saint EternalBlue, Escaped From the Arsenal · Saint EternalRomance
Works: The Scourge of NotPetya

A wiper disguised as ransomware launched on 27 June 2017 through a trojanised update of the Ukrainian accounting software M.E.Doc. It spread with EternalBlue, EternalRomance and stolen credentials, causing an estimated $10 billion in damage worldwide. The US, UK and others attributed it to Russia's GRU Sandworm unit, whose officers were indicted in 2020.

Sources: attack.mitre.org · attack.mitre.org · justice.gov · MITRE ATT&CK reference S0368