Scourge · June 27 2017

The Scourge of NotPetya

Chronicle

On 27 June 2017, on the eve of Ukraine's Constitution Day, a tampered update of M.E.Doc, tax-accounting software used across Ukraine, delivered NotPetya. It looked like ransomware but offered no way to recover data: it was a wiper. It spread with EternalBlue, EternalRomance and credentials stolen with Mimikatz, crippling Maersk, Merck, FedEx/TNT and many other companies, with damage estimated at around $10 billion, and also disrupted hospital services at Heritage Valley Health System in Pennsylvania. The US, UK and other countries attributed it to Russia's GRU (Sandworm).

Lesson learned

It revealed how dangerous the software supply chain can be and how an attack aimed at one country can overwhelm global companies. Maersk was saved partly by a domain controller in Ghana that happened to be offline.

Prayer of reparation

O NotPetya, who demanded a ransom without even holding the key, keep your hands off our updates and leave the right domain controller switched off. Amen.

How it is remembered

Remembered by verifying the integrity of supplier updates, segmenting the network, restricting admin accounts and keeping an offline copy of Active Directory.