Loading story…
NotPetya (also tracked as ExPetr/Petya.A) hit organizations as destructive malware masquerading as ransomware, encrypting or wiping systems after modifying the Windows Master Boot Record (MBR) and forcing a reboot that left victims unable to load Windows. Researchers observed the malware being launched via rundll32.exe, displaying a $300 Bitcoin ransom demand, and propagating laterally through Windows networks using SMB, WMIC, and the leaked NSA-linked exploits EternalBlue and EternalRomance against systems missing Microsoft’s MS17-010 patch for CVE-2017-0144.
Investigations tied the broader outbreak closely to Ukraine, where reporting pointed to a compromised MEDoc software update mechanism as the initial infection vector in a supply-chain attack. Later reporting said Ukrainian police arrested a 51-year-old man accused of distributing the malware through links shared on a blog and social media, allegedly causing about 400 infections. Separate research also noted low-confidence similarities between NotPetya and earlier BlackEnergy/TeleBots destructive operations, including overlapping file-extension targeting and shutdown behavior, reinforcing suspicions of a connection to prior Ukraine-focused attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
ESET published reporting that linked the activity to TeleBots and described supply-chain attacks against Ukraine. This represented an attribution-related development in understanding the campaign.
SANS analyzed DLL samples of the new Petya variant and observed execution via rundll32, MBR modification, a reboot into a fake CHKDSK sequence, and a ransom note demanding $300 in Bitcoin via a Posteo email address. The analysis also noted immediate port 445 traffic and ARP activity from infected hosts, supporting SMB-based propagation.
In June, Ukraine's Cyber Police said the broader outbreak's initial infection vector was the update mechanism of Ukrainian financial software provider MEDoc. Cisco, Kaspersky, and Microsoft were also cited as implicating MEDoc's compromised update system.
The EternalBlue exploit, later cited as a propagation mechanism for NotPetya/ExPetr, was released by the Shadow Brokers. The exploit targeted CVE-2017-0144.
BlackEnergy destructive malware, including KillDisk variants, was used in attacks in Ukraine and is widely associated with the 2015 Ukraine power grid attack. Later research compared NotPetya/ExPetr against these older samples.
Researchers later compared ExPetr/NotPetya with older BlackEnergy malware, finding similarities in targeted file extensions and some implementation patterns. They developed a YARA rule that matched only BlackEnergy and ExPetr samples in their collection, but stressed this was not definitive proof of a relationship.
Ukraine's Cyber Police arrested a 51-year-old man in Nikopol and charged him with distributing Petya.A/NotPetya. Authorities alleged he shared a video and links that led 400 victims to download the malware.
A new Petya variant was used in a widespread attack that heavily affected Ukraine and spread globally, damaging systems by overwriting the master boot record while posing as ransomware. Reports said it propagated over SMB using EternalBlue, with some also citing EternalRomance and WMIC-based movement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securelist.com
Open sourcethreatpost.com
Open sourcewelivesecurity.com
Open sourceisc.sans.edu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A global ransomware outbreak linked to the **NotPetya** malware family—also tracked as **Petrwrap**, **GoldenEye**, and **Nyetya**—encrypted files, altered the **Master Boot Record (MBR)**, and demanded a **$300 Bitcoin** payment from victims. The malware affected Microsoft Windows systems and was notable for rapidly moving through already-compromised environments rather than broadly scanning the internet for new targets. Advisories said NotPetya propagated laterally inside networks using the **EternalBlue** SMB exploit addressed by Microsoft's **`MS17-010`** bulletin, along with legitimate administration tools such as **PsExec** and **WMI**. Defenders were urged to apply the **`MS17-010`** security update, restrict or block SMB where feasible, update endpoint protections, isolate infected hosts, and avoid paying the ransom because recovery was not assured.
Aug 8, 2026
The malware outbreak initially labeled **Petya** spread rapidly from Ukraine to multinational networks worldwide, disrupting banks, airports, government agencies, utilities, media outlets, and major companies including **Maersk**, **Merck**, **DLA Piper**, **WPP**, and **Mondelez**. Investigators tied the initial infection chain to the update mechanism of the Ukrainian accounting software **M.E.Doc**, after which the malware propagated aggressively using the Windows SMB flaw patched in `MS17-010`, the leaked NSA-linked exploits **EternalBlue** and **EternalRomance**, credential theft tools such as **Mimikatz/LSADump**, and lateral movement through **PSExec** and **WMI**. Unlike conventional file-encrypting ransomware, it overwrote the master boot record and encrypted core disk structures, crippling systems across internal networks. Researchers and later government investigators concluded the operation was likely designed for destruction rather than profit, despite a **$300** bitcoin demand, because its payment and recovery process was effectively broken and victims had little realistic chance of restoration. The attack became widely known as **NotPetya**, and its financial impact ran into the hundreds of millions of dollars for some victims, with Maersk alone reporting losses on that scale. In 2020, the US Justice Department charged six alleged officers of Russia's **GRU Unit 74455** and linked the **Sandworm** group to NotPetya as part of a broader campaign of destructive cyber operations.
Jun 29, 2026
The **Petya** ransomware family used German-language job-application phishing emails, often linking to ZIP archives hosted on Dropbox, to infect primarily HR staff in German-speaking countries. Once launched, Petya sought elevated privileges through a Windows UAC prompt, unpacked a malicious `Setup.dll`, overwrote boot structures including the **MBR**, and encrypted the **NTFS Master File Table**, leaving systems unable to boot normally or access files after a forced reboot. The malware used a Tor-based payment site, victim identifiers, and a cryptographic workflow involving elliptic-curve cryptography, **AES**, **Base58**, and **Salsa20**. To improve infection success, the operators added **Mischa** as a fallback payload for cases where administrator rights were not obtained. Unlike Petya, Mischa could encrypt files without elevated privileges, worked offline, targeted a wide range of file types across fixed, removable, and remote drives, and used reflective DLL injection into `conhost.exe`. Researchers later described this dual-payload approach as evolving into **GoldenEye**, while noting that Mischa’s conventional file encryption could be harder to reverse through forensic recovery than Petya’s disk-level attack; the campaigns were widely linked to actors operating under the name **Janus**.
Aug 15, 2026