WiperATT&CK S0368
NotPetya
Also known as: ExPetr, Petrwrap, Nyetya, Diskcoder.C
NotPetya struck in June 2017. It looked like ransomware and displayed a ransom note, but it was built to destroy: victims could not recover their data even by paying. It began in Ukraine and spread to multinational companies with Ukrainian operations, causing some of the most expensive disruption of any cyber attack.
- Public attribution and associated actors
- Publicly attributed by the UK and US governments to the Russian military. In 2020 the US Department of Justice charged six officers of Russia's GRU over NotPetya and other destructive attacks.As publicly reported:Sandworm Team
- First seen
- 2017
- Platforms
- Windows
- MITRE ATT&CK software entries
- S0368 NotPetya
How it spreads or gets in
- Initial infections were traced in public analyses to a compromised update of M.E.Doc, Ukrainian accounting software.
- Spread internally as a worm using stolen credentials with remote administration tools, and SMB exploits.
Key behaviours
- Harvested credentials from memory to reach other hosts.
- Encrypted disk structures and files, then forced a reboot.
- Displayed a ransom note although recovery was not possible.
ATT&CK techniques
- T1195.002Supply Chain Compromise: Compromise Software Supply Chain
- T1210Exploitation of Remote Services
- T1003.001OS Credential Dumping: LSASS Memory
- T1021.002Remote Services: SMB/Windows Admin Shares
- T1047Windows Management Instrumentation
- T1053.005Scheduled Task/Job: Scheduled Task
- T1486Data Encrypted for Impact
- T1529System Shutdown/Reboot
Selected from the family's MITRE ATT&CK software entry, plus initial-access techniques named in the cited advisories.
Detection ideas
- Alert on remote service creation and WMI execution spreading across many hosts in minutes.
- Detect credential dumping attempts against LSASS.
- Monitor software update processes for unexpected child processes.
Defences that work
- Protect LSASS (Credential Guard) and use unique local administrator passwords.
- Segment networks and restrict admin protocols between workstations.
- Assess supplier software update channels as part of third-party risk.
- Plan for full rebuilds: offline backups and recovery runbooks.