campaign · 1498521600000

NotPetya Cyberattack

A devastating destructive malware attack initially disguised as ransomware, primarily targeting Ukraine.

What happened

NotPetya rapidly spread globally, destroying data on infected systems without providing a valid decryption mechanism.

Technical mechanism

Spread via a compromised update for the Ukrainian accounting software M.E.Doc, and propagated laterally using EternalBlue and EternalRomance.

Why it matters

Considered the most destructive and costly cyberattack in history, causing an estimated $10 billion in global damages.

Impact

Crippled multinational corporations including Maersk, Merck, and Mondelez, alongside widespread disruption in Ukraine.

Response

Organizations rebuilt entire IT infrastructures from scratch; international condemnation of the attack.

Defensive lessons

  • Supply chain risks are critical
  • Importance of offline backups
  • Lateral movement prevention is essential

Evidence register

  1. U.S. Department of Justice — DOJ Indictment of Sandworm (verified)