Loading story…
A global ransomware outbreak linked to the NotPetya malware family—also tracked as Petrwrap, GoldenEye, and Nyetya—encrypted files, altered the Master Boot Record (MBR), and demanded a $300 Bitcoin payment from victims. The malware affected Microsoft Windows systems and was notable for rapidly moving through already-compromised environments rather than broadly scanning the internet for new targets.
Advisories said NotPetya propagated laterally inside networks using the EternalBlue SMB exploit addressed by Microsoft's MS17-010 bulletin, along with legitimate administration tools such as PsExec and WMI. Defenders were urged to apply the MS17-010 security update, restrict or block SMB where feasible, update endpoint protections, isolate infected hosts, and avoid paying the ransom because recovery was not assured.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On June 27, 2017, multiple organizations worldwide reported disruptions caused by a ransomware outbreak attributed to a new Petya variant. The malware was referred to by names including NotPetya, Petrwrap, GoldenEye, and Nyetya.
Following the June 27, 2017 outbreak, Malaysia's National Cyber Coordination and Command Centre said it was closely monitoring for signs of infection or propagation in Malaysia. The advisory also urged organizations to patch systems, restrict SMB exposure, isolate infected hosts, and avoid paying the ransom.
Microsoft issued security bulletin MS17-010 for Windows SMB vulnerabilities later associated with EternalBlue-based malware propagation. The NACSA advisory specifically recommends applying MS17-010 as a mitigation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**NotPetya** (also tracked as **ExPetr/Petya.A**) hit organizations as destructive malware masquerading as ransomware, encrypting or wiping systems after modifying the Windows **Master Boot Record (MBR)** and forcing a reboot that left victims unable to load Windows. Researchers observed the malware being launched via `rundll32.exe`, displaying a **$300 Bitcoin** ransom demand, and propagating laterally through Windows networks using **SMB**, **WMIC**, and the leaked NSA-linked exploits **EternalBlue** and **EternalRomance** against systems missing Microsoft’s **MS17-010** patch for `CVE-2017-0144`. Investigations tied the broader outbreak closely to Ukraine, where reporting pointed to a compromised **MEDoc** software update mechanism as the initial infection vector in a supply-chain attack. Later reporting said Ukrainian police arrested a 51-year-old man accused of distributing the malware through links shared on a blog and social media, allegedly causing about **400 infections**. Separate research also noted low-confidence similarities between NotPetya and earlier **BlackEnergy/TeleBots** destructive operations, including overlapping file-extension targeting and shutdown behavior, reinforcing suspicions of a connection to prior Ukraine-focused attacks.
Aug 15, 2026
The malware outbreak initially labeled **Petya** spread rapidly from Ukraine to multinational networks worldwide, disrupting banks, airports, government agencies, utilities, media outlets, and major companies including **Maersk**, **Merck**, **DLA Piper**, **WPP**, and **Mondelez**. Investigators tied the initial infection chain to the update mechanism of the Ukrainian accounting software **M.E.Doc**, after which the malware propagated aggressively using the Windows SMB flaw patched in `MS17-010`, the leaked NSA-linked exploits **EternalBlue** and **EternalRomance**, credential theft tools such as **Mimikatz/LSADump**, and lateral movement through **PSExec** and **WMI**. Unlike conventional file-encrypting ransomware, it overwrote the master boot record and encrypted core disk structures, crippling systems across internal networks. Researchers and later government investigators concluded the operation was likely designed for destruction rather than profit, despite a **$300** bitcoin demand, because its payment and recovery process was effectively broken and victims had little realistic chance of restoration. The attack became widely known as **NotPetya**, and its financial impact ran into the hundreds of millions of dollars for some victims, with Maersk alone reporting losses on that scale. In 2020, the US Justice Department charged six alleged officers of Russia's **GRU Unit 74455** and linked the **Sandworm** group to NotPetya as part of a broader campaign of destructive cyber operations.
Jun 29, 2026
Researchers reported that attackers used **PetrWrap**, a customized ransomware strain built on **Petya v3**, in targeted intrusions against organizations. The malware spread laterally across compromised networks with **PsExec**, delayed execution to evade detection, and patched Petya at runtime to replace its original key-agreement process with the attackers’ own cryptographic implementation. It also modified the bootloader and ransom note to remove Petya branding while retaining Petya’s core disk-encryption behavior against **NTFS MFT** data using a Salsa20-based mechanism. The report said the changes gave operators control over decryption, unlike earlier Petya variants that had implementation flaws, and concluded that recovery through cryptanalysis was not feasible because the malware used strong encryption correctly. Researchers linked the attacks to broader post-compromise activity commonly seen in targeted ransomware operations, including credential theft with tools such as **Mimikatz**, abuse of vulnerable or weakly protected servers, and exploitation of exposed **RDP** access to move from initial access to full network-wide encryption.
Aug 14, 2026