Loading story…
The Petya ransomware family used German-language job-application phishing emails, often linking to ZIP archives hosted on Dropbox, to infect primarily HR staff in German-speaking countries. Once launched, Petya sought elevated privileges through a Windows UAC prompt, unpacked a malicious Setup.dll, overwrote boot structures including the MBR, and encrypted the NTFS Master File Table, leaving systems unable to boot normally or access files after a forced reboot. The malware used a Tor-based payment site, victim identifiers, and a cryptographic workflow involving elliptic-curve cryptography, AES, Base58, and Salsa20.
To improve infection success, the operators added Mischa as a fallback payload for cases where administrator rights were not obtained. Unlike Petya, Mischa could encrypt files without elevated privileges, worked offline, targeted a wide range of file types across fixed, removable, and remote drives, and used reflective DLL injection into conhost.exe. Researchers later described this dual-payload approach as evolving into GoldenEye, while noting that Mischa’s conventional file encryption could be harder to reverse through forensic recovery than Petya’s disk-level attack; the campaigns were widely linked to actors operating under the name Janus.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
In December 2016, the Petya and Mischa ransomware lines were merged with slight changes into GoldenEye, which continued using polished job-application phishing lures and automated ransom payment through a Tor hidden service.
The dual-payload Petya and Mischa campaign circulated in May 2016, with a Setup.dll-based installer choosing Petya when administrative privileges were available and Mischa otherwise.
Petya first appeared in March 2016, using phishing emails themed as German-language job applications and links to hosted files or ZIP archives to infect victims, particularly HR staff in German-speaking countries.
About half a year after GoldenEye, a newer ransomware that also rebooted systems and encrypted the Master File Table was initially called Petya, but researchers soon questioned that attribution and began referring to it as NotPetya, Nyetya, or Petna.
Analysis of the Petya/Mischa campaign showed that the dropper unpacked Setup.dll, decrypted embedded payloads, generated victim-specific data, and injected Mischa into conhost.exe using reflective DLL injection when privilege escalation failed.
Because Petya required administrator privileges, its operators introduced Mischa, a conventional file-encrypting ransomware that could run with only user-level privileges when elevation failed.
The Petya malware overwrote disk boot structures, forced a reboot, and then encrypted the NTFS Master File Table, preventing normal boot and access to files while presenting victims with a Tor-based ransom workflow.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
securelist.com
Open sourcegdatasoftware.com
Open sourcembsd.jp
Open sourceblog.avast.com
Open sourcemalwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that attackers used **PetrWrap**, a customized ransomware strain built on **Petya v3**, in targeted intrusions against organizations. The malware spread laterally across compromised networks with **PsExec**, delayed execution to evade detection, and patched Petya at runtime to replace its original key-agreement process with the attackers’ own cryptographic implementation. It also modified the bootloader and ransom note to remove Petya branding while retaining Petya’s core disk-encryption behavior against **NTFS MFT** data using a Salsa20-based mechanism. The report said the changes gave operators control over decryption, unlike earlier Petya variants that had implementation flaws, and concluded that recovery through cryptanalysis was not feasible because the malware used strong encryption correctly. Researchers linked the attacks to broader post-compromise activity commonly seen in targeted ransomware operations, including credential theft with tools such as **Mimikatz**, abuse of vulnerable or weakly protected servers, and exploitation of exposed **RDP** access to move from initial access to full network-wide encryption.
Aug 14, 2026
**NotPetya** (also tracked as **ExPetr/Petya.A**) hit organizations as destructive malware masquerading as ransomware, encrypting or wiping systems after modifying the Windows **Master Boot Record (MBR)** and forcing a reboot that left victims unable to load Windows. Researchers observed the malware being launched via `rundll32.exe`, displaying a **$300 Bitcoin** ransom demand, and propagating laterally through Windows networks using **SMB**, **WMIC**, and the leaked NSA-linked exploits **EternalBlue** and **EternalRomance** against systems missing Microsoft’s **MS17-010** patch for `CVE-2017-0144`. Investigations tied the broader outbreak closely to Ukraine, where reporting pointed to a compromised **MEDoc** software update mechanism as the initial infection vector in a supply-chain attack. Later reporting said Ukrainian police arrested a 51-year-old man accused of distributing the malware through links shared on a blog and social media, allegedly causing about **400 infections**. Separate research also noted low-confidence similarities between NotPetya and earlier **BlackEnergy/TeleBots** destructive operations, including overlapping file-extension targeting and shutdown behavior, reinforcing suspicions of a connection to prior Ukraine-focused attacks.
Aug 15, 2026
The malware outbreak initially labeled **Petya** spread rapidly from Ukraine to multinational networks worldwide, disrupting banks, airports, government agencies, utilities, media outlets, and major companies including **Maersk**, **Merck**, **DLA Piper**, **WPP**, and **Mondelez**. Investigators tied the initial infection chain to the update mechanism of the Ukrainian accounting software **M.E.Doc**, after which the malware propagated aggressively using the Windows SMB flaw patched in `MS17-010`, the leaked NSA-linked exploits **EternalBlue** and **EternalRomance**, credential theft tools such as **Mimikatz/LSADump**, and lateral movement through **PSExec** and **WMI**. Unlike conventional file-encrypting ransomware, it overwrote the master boot record and encrypted core disk structures, crippling systems across internal networks. Researchers and later government investigators concluded the operation was likely designed for destruction rather than profit, despite a **$300** bitcoin demand, because its payment and recovery process was effectively broken and victims had little realistic chance of restoration. The attack became widely known as **NotPetya**, and its financial impact ran into the hundreds of millions of dollars for some victims, with Maersk alone reporting losses on that scale. In 2020, the US Justice Department charged six alleged officers of Russia's **GRU Unit 74455** and linked the **Sandworm** group to NotPetya as part of a broader campaign of destructive cyber operations.
Jun 29, 2026