Loading story…
Researchers reported that attackers used PetrWrap, a customized ransomware strain built on Petya v3, in targeted intrusions against organizations. The malware spread laterally across compromised networks with PsExec, delayed execution to evade detection, and patched Petya at runtime to replace its original key-agreement process with the attackers’ own cryptographic implementation. It also modified the bootloader and ransom note to remove Petya branding while retaining Petya’s core disk-encryption behavior against NTFS MFT data using a Salsa20-based mechanism.
The report said the changes gave operators control over decryption, unlike earlier Petya variants that had implementation flaws, and concluded that recovery through cryptanalysis was not feasible because the malware used strong encryption correctly. Researchers linked the attacks to broader post-compromise activity commonly seen in targeted ransomware operations, including credential theft with tools such as Mimikatz, abuse of vulnerable or weakly protected servers, and exploitation of exposed RDP access to move from initial access to full network-wide encryption.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published technical analysis of PetrWrap, a ransomware family used in targeted attacks that spreads within compromised networks via PsExec and patches embedded Petya v3 at runtime. The report said the malware replaces Petya’s key-agreement mechanism with the attackers’ own cryptography, making decryption infeasible.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A global ransomware outbreak linked to the **NotPetya** malware family—also tracked as **Petrwrap**, **GoldenEye**, and **Nyetya**—encrypted files, altered the **Master Boot Record (MBR)**, and demanded a **$300 Bitcoin** payment from victims. The malware affected Microsoft Windows systems and was notable for rapidly moving through already-compromised environments rather than broadly scanning the internet for new targets. Advisories said NotPetya propagated laterally inside networks using the **EternalBlue** SMB exploit addressed by Microsoft's **`MS17-010`** bulletin, along with legitimate administration tools such as **PsExec** and **WMI**. Defenders were urged to apply the **`MS17-010`** security update, restrict or block SMB where feasible, update endpoint protections, isolate infected hosts, and avoid paying the ransom because recovery was not assured.
Aug 8, 2026
The **Petya** ransomware family used German-language job-application phishing emails, often linking to ZIP archives hosted on Dropbox, to infect primarily HR staff in German-speaking countries. Once launched, Petya sought elevated privileges through a Windows UAC prompt, unpacked a malicious `Setup.dll`, overwrote boot structures including the **MBR**, and encrypted the **NTFS Master File Table**, leaving systems unable to boot normally or access files after a forced reboot. The malware used a Tor-based payment site, victim identifiers, and a cryptographic workflow involving elliptic-curve cryptography, **AES**, **Base58**, and **Salsa20**. To improve infection success, the operators added **Mischa** as a fallback payload for cases where administrator rights were not obtained. Unlike Petya, Mischa could encrypt files without elevated privileges, worked offline, targeted a wide range of file types across fixed, removable, and remote drives, and used reflective DLL injection into `conhost.exe`. Researchers later described this dual-payload approach as evolving into **GoldenEye**, while noting that Mischa’s conventional file encryption could be harder to reverse through forensic recovery than Petya’s disk-level attack; the campaigns were widely linked to actors operating under the name **Janus**.
Aug 15, 2026
The malware outbreak initially labeled **Petya** spread rapidly from Ukraine to multinational networks worldwide, disrupting banks, airports, government agencies, utilities, media outlets, and major companies including **Maersk**, **Merck**, **DLA Piper**, **WPP**, and **Mondelez**. Investigators tied the initial infection chain to the update mechanism of the Ukrainian accounting software **M.E.Doc**, after which the malware propagated aggressively using the Windows SMB flaw patched in `MS17-010`, the leaked NSA-linked exploits **EternalBlue** and **EternalRomance**, credential theft tools such as **Mimikatz/LSADump**, and lateral movement through **PSExec** and **WMI**. Unlike conventional file-encrypting ransomware, it overwrote the master boot record and encrypted core disk structures, crippling systems across internal networks. Researchers and later government investigators concluded the operation was likely designed for destruction rather than profit, despite a **$300** bitcoin demand, because its payment and recovery process was effectively broken and victims had little realistic chance of restoration. The attack became widely known as **NotPetya**, and its financial impact ran into the hundreds of millions of dollars for some victims, with Maersk alone reporting losses on that scale. In 2020, the US Justice Department charged six alleged officers of Russia's **GRU Unit 74455** and linked the **Sandworm** group to NotPetya as part of a broader campaign of destructive cyber operations.
Jun 29, 2026