2017Wiper / destructiveSupply chainWorm
NotPetya attack
27 June 2017
NotPetya was pushed out through a compromised update of M.E.Doc, accounting software widely used in Ukraine, and then spread inside networks using stolen credentials and SMB exploits. It displayed a ransom demand but was designed so that data could not be recovered. Companies around the world with offices in Ukraine were badly hit.
- Victim
- Organisations in Ukraine and multinational companies with Ukrainian operations
- Sector
- Cross-sector (logistics, pharmaceuticals, manufacturing and others)
- Public attribution
- Publicly attributed by the UK and US governments to the Russian military; in 2020 the US Department of Justice charged six GRU officers over NotPetya and other attacks.Sandworm Team profile
- Malware
- NotPetya
Impact
Severe worldwide disruption; the UK government said it cost organisations across Europe hundreds of millions of pounds.
Root cause
A trusted software update channel was compromised, and flat networks with reusable administrator credentials let the malware spread rapidly.
Lessons learned: the controls it teaches
- Assess supplier software update channels as part of third-party risk management.
- Limit credential reuse and protect LSASS so one host cannot unlock the network.
- Plan for total loss: offline backups and the ability to rebuild domains and endpoints.