Loading story…
The malware outbreak widely referred to as Petya, NotPetya, or GoldenEye began with a malicious update delivered through the Ukrainian accounting software MeDoc, then rapidly propagated inside victim networks using worm-like techniques. Microsoft reported that the malware combined ransomware behavior with lateral movement through stolen credentials, WMI, PsExec, and SMB-based exploitation, including ETERNALBLUE and ETERNALROMANCE tied to CVE-2017-0144 and CVE-2017-0145.
Once executed, the malware encrypted files, could overwrite the Master Boot Record (MBR), and erased Windows Event Logs, amplifying operational disruption across affected organizations. Advisory reporting said there was no practical decryption path because the email account used for ransom communications was shut down, while defenders were urged to segment SMB access, disable SMBv1 and WMIC where possible, apply Microsoft patches, maintain reliable backups, and ensure endpoint protection was updated.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
The advisory states that no decryption solution was available and that the email account used for ransom communications had been closed by the provider. As a result, paying the listed bitcoin ransom would not yield decryption tools or keys.
Over the prior 24 hours on 27 June 2017, the ransomware spread globally and propagated laterally using stolen credentials, WMI, PsExec, and the SMBv1 exploits ETERNALBLUE and ETERNALROMANCE. The malware also encrypted files, could overwrite the master boot record, and erased Windows Event Logs.
The only confirmed initial infection vector described was a malicious software update delivered through the Ukrainian tax accounting software MeDoc. This compromise seeded the ransomware outbreak that then spread inside victim networks.
Microsoft had already released patches in March 2017 for the SMBv1 vulnerabilities CVE-2017-0144 and CVE-2017-0145, which the malware later exploited via ETERNALBLUE and ETERNALROMANCE for lateral movement.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A global ransomware outbreak linked to the **NotPetya** malware family—also tracked as **Petrwrap**, **GoldenEye**, and **Nyetya**—encrypted files, altered the **Master Boot Record (MBR)**, and demanded a **$300 Bitcoin** payment from victims. The malware affected Microsoft Windows systems and was notable for rapidly moving through already-compromised environments rather than broadly scanning the internet for new targets. Advisories said NotPetya propagated laterally inside networks using the **EternalBlue** SMB exploit addressed by Microsoft's **`MS17-010`** bulletin, along with legitimate administration tools such as **PsExec** and **WMI**. Defenders were urged to apply the **`MS17-010`** security update, restrict or block SMB where feasible, update endpoint protections, isolate infected hosts, and avoid paying the ransom because recovery was not assured.
Aug 8, 2026
**NotPetya** (also tracked as **ExPetr/Petya.A**) hit organizations as destructive malware masquerading as ransomware, encrypting or wiping systems after modifying the Windows **Master Boot Record (MBR)** and forcing a reboot that left victims unable to load Windows. Researchers observed the malware being launched via `rundll32.exe`, displaying a **$300 Bitcoin** ransom demand, and propagating laterally through Windows networks using **SMB**, **WMIC**, and the leaked NSA-linked exploits **EternalBlue** and **EternalRomance** against systems missing Microsoft’s **MS17-010** patch for `CVE-2017-0144`. Investigations tied the broader outbreak closely to Ukraine, where reporting pointed to a compromised **MEDoc** software update mechanism as the initial infection vector in a supply-chain attack. Later reporting said Ukrainian police arrested a 51-year-old man accused of distributing the malware through links shared on a blog and social media, allegedly causing about **400 infections**. Separate research also noted low-confidence similarities between NotPetya and earlier **BlackEnergy/TeleBots** destructive operations, including overlapping file-extension targeting and shutdown behavior, reinforcing suspicions of a connection to prior Ukraine-focused attacks.
Aug 15, 2026
The malware outbreak initially labeled **Petya** spread rapidly from Ukraine to multinational networks worldwide, disrupting banks, airports, government agencies, utilities, media outlets, and major companies including **Maersk**, **Merck**, **DLA Piper**, **WPP**, and **Mondelez**. Investigators tied the initial infection chain to the update mechanism of the Ukrainian accounting software **M.E.Doc**, after which the malware propagated aggressively using the Windows SMB flaw patched in `MS17-010`, the leaked NSA-linked exploits **EternalBlue** and **EternalRomance**, credential theft tools such as **Mimikatz/LSADump**, and lateral movement through **PSExec** and **WMI**. Unlike conventional file-encrypting ransomware, it overwrote the master boot record and encrypted core disk structures, crippling systems across internal networks. Researchers and later government investigators concluded the operation was likely designed for destruction rather than profit, despite a **$300** bitcoin demand, because its payment and recovery process was effectively broken and victims had little realistic chance of restoration. The attack became widely known as **NotPetya**, and its financial impact ran into the hundreds of millions of dollars for some victims, with Maersk alone reporting losses on that scale. In 2020, the US Justice Department charged six alleged officers of Russia's **GRU Unit 74455** and linked the **Sandworm** group to NotPetya as part of a broader campaign of destructive cyber operations.
Jun 29, 2026