NotPetya: The $10 Billion Cyberattack Disguised as Ransomware
On 27 June 2017, a routine software update in Ukraine unleashed NotPetya — malware that looked like ransomware but was built to destroy. It spread worldwide, caused over $10 billion in damage, and was later attributed to Russia's GRU. Here is how it worked, and why it still matters.
On the twenty-seventh of June, 2017, a piece of accounting software updated itself on computers across Ukraine. It was routine. It happened all the time. Within hours, banks went dark, hospitals fell back to pen and paper, the radiation-monitoring system at Chernobyl went offline, and a shipping company on the other side of the planet — with no office in Ukraine at all — began losing its entire global network.
This is the story of NotPetya. It looked like ransomware. It was never meant to make money.
This is cyber crime research, compiled from public reporting and government attributions. Sources are listed at the end. Watch the full documentary on the channel: YouTube — @devsecknight (direct video link added at publish).
A routine update that wasn't: the M.E.Doc supply chain
The entry point was not a phishing email or a leaked password. It was a trusted piece of software.
M.E.Doc was tax and accounting software used by a huge share of the businesses operating in Ukraine. If a company filed taxes or ran payroll in the country, there was a good chance M.E.Doc was somewhere on its network.
Sometime around April 2017 — possibly earlier — attackers obtained administrator credentials for M.E.Doc's own infrastructure. The exact method was never conclusively established in public technical reports; it may have involved phishing, earlier malware, credential reuse, or another intrusion entirely. What is clear is what they did next: they reached into M.E.Doc's software-update system and used that trusted channel to push a malicious version to users.
This is what makes NotPetya a textbook software supply-chain attack. Every piece of security advice tells you to keep your software updated — updates are supposed to be the safe thing. The attackers did not need to trick a single employee into clicking anything. They became the update.
Background: Ukraine under cyber siege (2014–2017)
NotPetya did not appear in a vacuum. Conflict between Russia and Ukraine had been ongoing since 2014, and from that year on, Ukraine was hit by cyberattacks almost annually — government systems one year, energy infrastructure the next. Each was, in effect, a rehearsal. NotPetya would become the largest and most destructive of them all.
The malware launched on 27 June 2017, one day before Ukraine's Constitution Day, a national holiday. One theory holds it was timed to strike during the final working hours before the break, when IT staff would be thin on the ground; another, simpler explanation is that it fired whenever the poisoned update went live. Both are plausible, and neither has been conclusively proven.
How NotPetya worked, step by step
NotPetya borrowed heavily from the earlier Petya ransomware, but its behaviour set it apart. Here is what it did once it ran.
1. Arming itself
It did not start destroying immediately. First it prepared, dropping tools to spread across the network: a credential-stealing component similar to Mimikatz, the remote-execution tool PsExec, and Windows' own administrative utilities such as WMIC and administrative shares. It armed itself using tools already trusted inside the enterprise.
2. Stealing credentials
It then read credentials out of LSASS (the Local Security Authority Subsystem Service), where passwords, NTLM hashes, and Kerberos tickets can live in memory. The goal was valid administrator credentials that could be reused on other machines.
3. Spreading: EternalBlue, EternalRomance and stolen keys
With admin credentials in hand, it scanned the local network and moved laterally in two ways:
- Using stolen credentials, like a thief with a master key.
- Exploiting SMB via two leaked NSA exploits, EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0145).
Microsoft had patched these flaws months earlier, but only patched machines were protected. The loop — credentials → discover → propagate → exploit → repeat — is how a single infected accounting program became an enterprise-wide outbreak in minutes.
4. Destruction: file encryption, the MBR and the fake CHKDSK
The destructive stage worked in layers. NotPetya encrypted selected files directly — documents, databases, archives, virtual-machine files. It then overwrote the Master Boot Record (MBR), the small piece of code a computer reads before Windows even starts, replacing it with its own.
It scheduled a reboot roughly an hour later — a delay that bought time to keep spreading. On restart, the screen displayed what looked exactly like CHKDSK, Windows' routine disk-repair process. It was lying: underneath that fake progress bar, NotPetya was encrypting the Master File Table (MFT), the index that tells Windows where every file lives. Encrypt that index and the files may still physically exist, but the operating system can no longer find a single one.
The fake CHKDSK screen. While it claimed to be "repairing" the disk, NotPetya was encrypting the Master File Table underneath.
The ransom that was never real
Only then did the ransom note appear, demanding payment in Bitcoin. To anyone watching, it looked exactly like ransomware. Except it wasn't.
The ransom note: $300 in Bitcoin and an email address. It looked like ordinary ransomware — which was exactly the point.
The ransom screen displayed an "installation ID" meant to identify each victim so the attacker could supply the right decryption key. In earlier Petya variants, that identifier genuinely encoded the data needed to recover files. Researchers at Kaspersky examined NotPetya's version and found it was random — it encoded nothing at all. There was no key to send back, which meant even an attacker who wanted to help could not. This single detail is why researchers reclassified NotPetya as a wiper masquerading as ransomware. The payment screen was not a business model; it was a distraction.
The giveaway: the "installation ID" was filled with CryptGenRandom output — pure random bytes. It encoded nothing, so no key could ever be derived from it.
Who survived — and the "perfc vaccine"
Not every machine fell. Researcher Amit Serper found, within a day, that the malware checked for a specific file (named like perfc) in the Windows folder before running its destructive payload; if that file already existed, it stood down. It was not a cure — more an accidental off-switch that could be defeated the moment attackers changed the check — but placing that file in advance was the closest thing to a vaccine during that chaotic week.
Machines also survived if they were offline, not running Windows, disconnected from the network, never touched by M.E.Doc, or had the outdated SMBv1 protocol disabled. NotPetya needed a very specific set of doors left open.
The dark-web bargain
A few days after the outbreak, the single email address on the ransom note was shut down by its provider. Then a message appeared on a dark-web paste site, claiming to be from NotPetya's authors and demanding 100 bitcoin for a master key to unlock every affected disk. Security researchers tested it: the group decrypted a sample file, but an ESET analysis found the key worked only on the file-level encryption, not the boot-disk encryption that made whole machines unusable. Even the "proof" was theater. Shortly after, the group moved its remaining Bitcoin and went quiet.
The dark-web message demanding 100 bitcoin for a "master key". The decryption it offered only ever worked on file-level encryption, never the wiped boot disks.
The global fallout: Maersk, FedEx, Merck and $10 billion
More than 1,500 Ukrainian organizations reported being affected, but the worm did not respect borders — it spread through the global networks of multinational companies that merely had a presence in Ukraine.
- Maersk, the world's largest container-shipping company, had its global operations crippled and reinstalled roughly 45,000 PCs and 4,000 servers. Recovery was only possible because a domain controller in a Ghana office happened to be offline during the attack, preserving an intact copy of its directory. Estimated loss: $200–300 million.
- TNT Express (owned by FedEx) lost parcel-tracking and sorting across Europe for weeks. Estimated loss: ~$300 million.
- Merck, one of the world's largest pharmaceutical companies, had manufacturing and research halted, contributing to medicine shortages. Estimated loss: ~$310 million, followed by a landmark legal battle with its insurer over an "act of war" exclusion.
Added together, the global damage is estimated at over $10 billion — for software that never functioned as ransomware at all.
Attribution: Sandworm and GRU Unit 74455
For months, attribution stayed circumstantial. Then, in February 2018, the United Kingdom, United States, Australia, New Zealand, and Denmark publicly attributed NotPetya to the Russian military within days of each other. Russia denied involvement.
In October 2020, the U.S. Department of Justice charged six officers of Russia's military-intelligence agency, the GRU, identifying Unit 74455 — tracked by researchers as Sandworm (also Voodoo Bear, Iron Viking). The same unit has been linked to attacks on Ukraine's power grid and to disruption at the 2018 Winter Olympics, placing NotPetya inside a broader military cyber-operations program rather than an isolated criminal incident.
Why NotPetya still matters
NotPetya's authors relied on two things that did not have to exist: a vulnerability the NSA had stockpiled in secret for years until it was stolen and leaked by the Shadow Brokers, and a software-update channel that every one of its victims had been taught, correctly, to trust.
It was never really about Ukraine's accounting software. Ukraine was simply where the detonator sat — and the explosion did not check borders on its way out. For defenders, the lessons endure: patch aggressively, segment networks, limit where administrator credentials are exposed, and treat the software supply chain as part of your attack surface.
References
- BBC News — Ukraine cyber-attack
- Wired — How Mimikatz became the go-to hacker tool
- Microsoft Security — Technical analysis of NotPetya
- CISA — Petya ransomware alert
- MITRE ATT&CK — NotPetya (S0368)
- Huntress — NotPetya threat library
- BBC News — NotPetya ransom and recovery
- Microsoft — Security bulletin MS17-010
- BleepingComputer — NotPetya group moves their Bitcoin
- BBC News — Bitcoin payments to the ransom wallet
- InfoQ — NotPetya retrospective
- BleepingComputer — The perfc "vaccine"
- The Loop (ECPR) — NotPetya and the limits of economic impact
- CyberScoop — NotPetya cost Merck $310 million
- BBC News — Maersk and global impact
- Reuters — Merck says cyber-attack halted production
- Wired — The untold story of NotPetya
- Reuters — Russia denies British allegations
- BleepingComputer — M.E.Doc software was backdoored
- U.S. Department of Justice — Six Russian GRU officers charged
- ESET — Links between NotPetya and Industroyer
- Securelist (Kaspersky) — ExPetr/Petya/NotPetya is a wiper, not ransomware
- Forbes — NotPetya hackers demand Bitcoin to cure victims
For educational and research purposes. Follow @devsecknight for more cyber crime research.