Loading malware…
Moonraker Petya is a worm that ESET reported GreyEnergy deployed in December 2016, prior to the June 2017 NotPetya attacks. ESET assessed it as a predecessor to NotPetya and described it as a more advanced Petya variant used in a separate GreyEnergy campaign. The malware was associated with GreyEnergy, a BlackEnergy successor subgroup linked to targeting critical infrastructure organizations in Central and Eastern Europe, especially Ukraine, with victims in sectors including energy and transportation. According to the provided content, Moonraker Petya had limited propagation via PsExec and included destructive and crypto functionality. The content does not provide additional high-confidence technical details or indicators of compromise specific to Moonraker Petya.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
In December 2016 the attackers deployed a worm that we believe to have been a predecessor to NotPetya... hence we named this worm Moonraker Petya.
In December 2016 the attackers deployed a worm that we believe to have been a predecessor to NotPetya... hence we named this worm Moonraker Petya.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.