Destructive malware released on 27 June 2017 that presented itself as ransomware. It encrypted files and overwrote the master boot record, displaying a payment demand, while lacking any mechanism to restore data. It spread from a compromised update to M.E.Doc, tax accounting software widely used in Ukraine, and then propagated inside networks on its own.

Why is it called NotPetya?

Because it reused code and presentation from an earlier ransomware family called Petya, so initial reports identified it as that. Analysis quickly showed the encryption was not reversible and the payment path was non-functional, making it a wiper wearing the appearance of ransomware, and the name stuck to mark the difference.

How did it spread if machines were patched?

Through two paths. Unpatched machines fell to the EternalBlue and EternalRomance exploits against SMB. Patched machines fell to credential theft: the malware harvested credentials from memory on an infected host and used them with legitimate administrative tools such as PsExec and WMI to execute on other machines. Those tools are working as designed when given valid administrative credentials, so a fully patched estate with a shared local administrator account was still taken.

Could victims recover by paying?

No. The installation identifier displayed to victims was random data rather than an encoding of the key, so there was no way for the operators to determine which key belonged to which victim even if they had wanted to help. The single email address for contact was disabled by its provider within hours. Recovery came from backups and rebuilds.

What happened to Maersk?

The shipping company's IT estate was destroyed, with around 45,000 PCs and 4,000 servers rendered unusable, and terminals worldwide disrupted. Recovery required rebuilding the domain from a copy of Active Directory found on a domain controller in Ghana that had been offline during the attack because of a power outage. The rebuild took roughly ten days and the company reported direct losses of around 300 million dollars.

The US, UK, Australian and Danish governments publicly attributed the attack to the Russian military in February 2018. Attribution of this kind is a government assessment rather than an independently verifiable technical fact, and it is reported here as the claim that it is.

NotPetya: A Wiper Dressed as Ransomware, Delivered by an Update

Six weeks after WannaCry, something that looked like the same thing happened again, and it was a different kind of event entirely.

NotPetya displayed a ransom note, asked for Bitcoin, and could not give anything back. There was no decryption, no key management, and no functioning way to contact the operators. The encryption was destruction with a payment screen attached, which is why the first hours were spent on the wrong problem: organisations treated a total loss as a recoverable ransomware incident.

It also demonstrated that patching, on its own, was not enough. Machines with MS17-010 applied were still destroyed, because the malware carried a second method that needed no vulnerability at all.

Timeline

Date	Event
Before June 2017	Attackers compromise the update mechanism of M.E.Doc, Ukrainian tax accounting software
27 June 2017	A malicious update is distributed. Infections begin in Ukraine and spread through connected networks worldwide within hours
27 June 2017	The contact email address in the ransom note is disabled by its provider, removing any payment path
28 June 2017 onward	Analysis establishes that recovery by payment is impossible by design
July 2017 onward	Maersk, Merck, FedEx's TNT Express, Mondelez, Reckitt and others disclose material losses
15 February 2018	The US, UK, Australia and Denmark attribute the attack to the Russian military
2018 to 2024	Insurance litigation over act-of-war exclusions, ending in settlements

Delivery: a legitimate update

The initial vector was the update mechanism for M.E.Doc, accounting software required in practice for filing tax in Ukraine. Attackers compromised the update infrastructure and pushed malware through it.

Every property that makes an update channel work made this effective. The software was expected to update itself. The update came from the vendor's own servers. Any organisation doing business in Ukraine, including the local subsidiaries of multinationals, was likely running it.

That last point is what made a regional attack global within hours. A Ukrainian office of a shipping company or a pharmaceutical firm was connected to the corporate network like any other office. The malware did not need to cross borders itself; the corporate WAN was already there.

This is the same structural lesson as SolarWinds and SUNBURST, reached faster and with a blunter payload: the update channel is a trusted path into everything that trusts it.

Propagation: two methods, one of them unpatchable

Exploits. EternalBlue and EternalRomance against SMB, the same family used by WannaCry. Unpatched machines fell immediately.

Stolen credentials. This is the part that made patching insufficient. On an infected machine, the malware extracted credentials from memory, then used them against other machines with legitimate administrative tooling: PsExec and WMI, both standard Windows administration mechanisms.

Nothing about that second path is a vulnerability. A valid administrative credential used through a supported remote execution tool is administration. No patch prevents it, no exploit mitigation applies, and the tooling behaves exactly as designed. Pass the Hash Explained and Living Off the Land Explained cover the two halves.

The consequence is the practical lesson of this incident: an estate where one account has local administrator rights on every machine is one credential away from total loss. If that account's credential is in memory anywhere, it is available to anything that gets on that host. Unique per-machine local administrator passwords, which Windows LAPS now provides natively, break the chain. So does the tiering model in Privileged Access Management Explained, which stops administrative credentials from being present on ordinary workstations in the first place.

Destruction, not extortion

Several details establish that recovery was never on offer.

The identifier shown to victims, which in real ransomware encodes information needed to derive their key, was random data. There was no mapping from a victim to a key, so even a cooperative operator could not have decrypted anything.

Payment ran through a single Bitcoin address and a single email address for contact, which the email provider disabled within hours. Real ransomware operations run infrastructure precisely because the business depends on victims believing payment works.

And the master boot record was overwritten, so machines did not boot. Files were also encrypted, and the boot damage alone made a host unusable.

The operational lesson is diagnostic. Establish early whether an event is recoverable by payment, because the answer changes the entire response. In the first hours, organisations negotiated, prepared payment and waited, when the correct move was to declare a destructive incident and start rebuilding.

The Maersk rebuild

The shipping company's experience is the most detailed public account of recovery from a destructive incident at scale.

Around 45,000 PCs and 4,000 servers were rendered unusable. Terminals around the world could not process cargo. Rebuilding the environment required Active Directory, and every domain controller had been destroyed, which normally means the identity infrastructure cannot be reconstructed at all.

One domain controller in Ghana had been offline during the attack because of a local power outage. That machine held an intact copy of the directory, and it became the seed for the entire rebuild. The recovery took roughly ten days for core systems, and the company reported direct losses of around 300 million dollars.

Two things follow from that, and the first is the uncomfortable one. The recovery depended on an accident. No plan called for an offline domain controller in Ghana; a power cut created one. Every organisation should ask what its answer would have been without that luck.

Identity is the recovery dependency nobody plans for. Restoring file servers is straightforward when there is a directory to authenticate against. With every domain controller destroyed, the restore procedure for everything else has no foundation. An offline, tested copy of the directory belongs in the recovery plan alongside data backups, which is the argument made in 3-2-1 Backup Strategy.

The insurance aftermath

Several victims claimed under property and cyber policies, and insurers denied claims citing exclusions for hostile or warlike acts by a government or sovereign power, pointing to the state attribution.

The litigation ran for years and ended in settlements rather than a definitive ruling in the largest cases. The lasting effect was on the market: cyber policies were rewritten with more specific war and state-actor language, and organisations now have to read those clauses carefully rather than assume that a state-attributed attack is covered.

For risk planning, the point is narrow and important: attribution can affect whether your insurance responds, and that is a question to settle with your broker before an incident rather than during one.

What generalises

A trusted update channel reaches everything that trusts it, including through a small regional subsidiary into a global network.
Patching is necessary and not sufficient. Credential theft plus built-in administration tools needs no vulnerability.
Shared local administrator credentials are the amplifier. Unique per-machine passwords and tiering remove the path.
Determine recoverability early. A destructive event dressed as ransomware wastes the first hours if you take the note at face value.
Plan for rebuilding identity, because restoring data onto an environment with no directory is not a recovery.
Read the war exclusion in your cyber policy.

The verdict

NotPetya was a destructive operation using the mechanics of ransomware as camouflage, delivered through a legitimate software update, and it reached organisations that had never heard of the software involved because they had an office in the country where it was used.

Its most useful lesson is the one about credentials. The victims who were fully patched still lost their estates, because a single administrative credential in memory and a standard Windows remote execution tool were enough. That path is still open in most organisations today.