Loading malware…
NotPetya, also known as Nyetya and ExPetr, is destructive Windows malware with worm-like propagation that caused a major international outbreak on June 27, 2017. It masquerades as ransomware but functions as a wiper: its encryption design does not provide a reliable recovery mechanism linking victims’ installation identifiers to their encryption keys. The operation is attributed to Sandworm, a unit associated with Russia’s military intelligence agency, the GRU.
The outbreak began through a software supply-chain compromise of M.E.Doc, a Ukrainian accounting application, whose legitimate update mechanism was used to distribute malicious code. NotPetya harvests Windows credentials using a modified Mimikatz component and uses stolen credentials with PsExec and Windows Management Instrumentation to execute on other systems. It also scans for vulnerable SMB services and propagates through the EternalBlue and EternalRomance SMBv1 exploits. Credential-based propagation allows it to compromise reachable systems even when the exploited SMB vulnerabilities have been patched. It disguises its dropped PsExec utility through renaming.
NotPetya encrypts selected user files with dynamically generated AES keys. With administrator privileges, it modifies the master boot record to initiate encryption of critical disk structures, including the master file table, and reboots the host, rendering it unusable. Although the malware displays ransom demands, payment does not offer a dependable means of restoring affected data.
Initially directed at Ukrainian organizations, NotPetya spread internationally and caused billions of dollars in damage across shipping, logistics, energy, manufacturing, finance, and healthcare. Its impact at Maersk included the loss or incapacitation of nearly all Active Directory domain controllers and major disruption to global shipping and port operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The manual contains an MS17-010 section discussing vulnerable Windows systems. The report also states that WannaCry, Petya, and NotPetya leveraged EternalBlue.
NotPetya's lateral movement techniques include “EternalRomance - another Windows SMBv1 exploit.” The alert explicitly lists CVE-2017-0145 among the vulnerabilities placing unpatched Windows systems at risk.
These documents use the CVE-2017-0199 Office RTF vulnerability to download and run the Petya installer, which then executes the SMB worm and spreads to new computers on the same network.
Dillon has crafted his modified exploits to take advantage of the following vulnerabilities: CVE-2017-0143 Type confusion between WriteAndX and Transaction requests EternalRomance EternalSynergy
9 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The group has been linked to some of the most consequential cyberattacks of the past decade, including attacks that disrupted Ukraine’s power grid and the NotPetya outbreak.
The NotPetya attack of 2017, attributed to the GRU’s Sandworm unit, exemplifies this. Using the EternalBlue exploit, the attack was ostensibly targeted at Ukraine but spread globally, causing over $10 billion in damages.
Much has been written about the recent ExPetr/NotPetya/Nyetya/Petya outbreak... To date, nobody has been able to find any significant code sharing between ExPetr/Petya and older malware.
In October 2020, DOJ indicted members of GRU Unit 74455 for numerous cyberattacks, including the 2017 NotPetya Malware attack.
However, the technique of autonomous spread was like the NotPetya malware, attributed to APT28.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
If Petya finds valid credentials, it will use either PsExec or WMIC to infect other computers connected to the LAN... Lateral movements (remote WMI): "process call create \"C:\\Windows\\System32\\rundll32.exe \\\"C:\\Windows\\perfc.dat\\\" #1"
It also contains a lightweight version of Mimikatz. It is used to dump valid credentials from memory... After initial infection, the ransomware will drop a tool in the %temp% folder, of what seems to be a lightweight version of Mimikatz... The tools are used to steal valid credentials to spread to other hosts in the network.
After establishing a cryptographic context, the process recursively browses the file system, looks for files with specific extensions, and encrypts them.
If Petya finds valid credentials, it will use either PsExec or WMIC to infect other computers connected to the LAN.
EternalBlue required zero user interaction and zero authentication, allowing it to spread laterally across networks at machine speed. The article also recommends restricting internal SMB traffic to limit the blast radius of lateral movement.
MS08-067 allowed an unauthenticated attacker to send a specially crafted RPC request over SMB and obtain SYSTEM-level privileges. EternalBlue targeted SMBv1 transaction handling and spread laterally across networks without authentication or user interaction.
A sudden spike in SMB2_CREATE requests followed by rapid SMB2_READ operations across hundreds of distinct file extensions may indicate ransomware actively encrypting a file share.
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Described as a Russian worm and cited alongside WannaCry as having caused tens of billions of dollars in worldwide damage. Included only as historical context.
Destructive malware cited as a historical example of why identity resilience matters. In the 2017 Maersk incident, it wiped or rendered unusable nearly all Active Directory domain controllers, disrupting shipping and port operations. One controller survived because its office was disconnected during a power outage, enabling reconstruction of the global identity environment.
Mentioned as a historical comparison: the 2017 attack disrupted Maersk’s shore and terminal systems without preventing its vessels from maneuvering. The article does not link NotPetya to the current tanker intrusion.
Described as a wiper, rather than ransomware, that affected Maersk’s booking, EDI, and terminal operations worldwide in 2017.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.