Loading malware…
NotPetya is malware that initially appeared to be ransomware but was later identified as a destructive wiper. The provided content states that it spread globally on 2017-06-27, used the EternalBlue vulnerability, and was attributed to Russian state-sponsored actors, specifically Sandworm / the Russian GRU. It is described as specifically targeting Ukrainian users and as being delivered through a supply-chain compromise of the M.E.Doc update mechanism, making it one of the most damaging supply-chain incidents cited in the content. The content also notes that its early activity drew comparisons to WannaCry because both leveraged EternalBlue. High-confidence behaviors and context directly mentioned here are destructive impact, pseudo-ransomware presentation, global propagation, exploitation of EternalBlue, and distribution via the compromised M.E.Doc software update channel. The content does not provide specific file hashes, domains, IPs, or other concrete IOCs.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
NotPetya is a destructive malware that masquerades as ransomware but primarily functions as a wiper, causing widespread disruption and data loss. It was delivered via a supply chain attack on the ME/doc software update mechanism.
NotPetya is a destructive wiper malware that masquerades as ransomware. It spreads via the EternalBlue vulnerability and supply chain attacks (notably via M.E.Doc software updates). Its primary purpose is data destruction, not financial gain, and it is attributed to Russian state-sponsored actors.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.