1. Home
  2. Software
  3. NotPetya

NotPetya

NotPetya is malware that was used by Sandworm Team in a worldwide attack starting on June 27, 2017. While NotPetya appears as a form of ransomware, its main purpose was to destroy data and disk structures on compromised systems; the attackers never intended to make the encrypted data recoverable. As such, NotPetya may be more appropriately thought of as a form of wiper malware. NotPetya contains worm-like features to spread itself across a computer network using the SMBv1 exploits EternalBlue and EternalRomance.[1][2][3][4]

ID: S0368
ⓘ
Associated Software: ExPetr, Diskcoder.C, GoldenEye, Petrwrap, Nyetya
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 2.0
Created: 26 March 2019
Last Modified: 16 April 2025

Associated Software Descriptions

Name Description
ExPetr

[3]
Diskcoder.C

[3]
GoldenEye

[1]
Petrwrap

[1][3]
Nyetya

[1]
Enterprise Layer
download view
ICS Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1047 Windows管理规范

NotPetya can use wmic to help propagate itself across a network.[1][2]
Enterprise T1036 伪装

NotPetya drops PsExec with the filename dllhost.dat.[1]
Enterprise T1003 .001 操作系统凭证转储: LSASS Memory

NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement.[1][2][5]
Enterprise T1486 数据加密以实现影响

NotPetya encrypts user files and disk structures like the MBR with 2048-bit RSA.[1][2][4]
Enterprise T1083 文件和目录发现

NotPetya searches for files ending with dozens of different file extensions prior to encryption.[4]
Enterprise T1078 .003 有效账户: Local Accounts

NotPetya can use valid credentials with PsExec or wmic to spread itself to remote systems.[1][2]
Enterprise T1070 .001 移除指标: Clear Windows Event Logs

NotPetya uses wevtutil to clear the Windows event logs.[1][4]
Enterprise T1218 .011 系统二进制代理执行: Rundll32

NotPetya uses rundll32.exe to install itself on remote systems when accessed via PsExec or wmic.[1]
Enterprise T1529 系统关机/重启

NotPetya will reboot the system one hour after infection.[1][4]
Enterprise T1569 .002 系统服务: Service Execution

NotPetya can use PsExec to help propagate itself across a network.[1][2]
Enterprise T1518 .001 软件发现: Security Software Discovery

NotPetya determines if specific antivirus programs are running on an infected host machine.[4]
Enterprise T1021 .002 远程服务: SMB/Windows Admin Shares

NotPetya can use PsExec, which interacts with the ADMIN$ network share to execute commands on remote systems.[1][2][6]
Enterprise T1210 远程服务漏洞利用

NotPetya can use two exploits in SMBv1, EternalBlue and EternalRomance, to spread itself to other remote systems on the network.[1][2][4]
Enterprise T1053 .005 预定任务/作业: Scheduled Task

NotPetya creates a task to reboot the system one hour after infection.[1]
ICS T0866 Exploitation of Remote Services

NotPetya initially infected IT networks, but by means of an exploit (particularly the SMBv1-targeting MS17-010 vulnerability) spread to industrial networks. [7]
ICS T0867 Lateral Tool Transfer

NotPetya can move laterally through industrial networks by means of the SMB service. [7]
ICS T0828 Loss of Productivity and Revenue

NotPetya disrupted manufacturing facilities supplying vaccines, resulting in a halt of production and the inability to meet demand for specific vaccines. [8]

Groups That Use This Software

ID Name References
G0034 Sandworm Team

[9][4][10][11][12][13]

References

  1. Chiu, A. (2016, June 27). New Ransomware Variant "Nyetya" Compromises Systems Worldwide. Retrieved March 26, 2019.
  2. US-CERT. (2017, July 1). Alert (TA17-181A): Petya Ransomware. Retrieved March 15, 2019.
  3. Cherepanov, A.. (2017, June 30). TeleBots are back: Supply chain attacks against Ukraine. Retrieved June 11, 2020.
  4. Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.
  5. The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.
  6. Russinovich, M. (2004, June 28). PsExec. Retrieved December 17, 2015.
  7. Joe Slowik 2019, April 10 Implications of IT Ransomware for ICS Environments Retrieved. 2019/10/27
  1. David Voreacos, Katherine Chinglinsky, Riley Griffin 2019, December 03 Merck Cyberattacks $1.3 Billion Question: Was It an Act of War? Retrieved. 2019/12/06
  2. NCSC. (2020, February 20). NCSC supports US advisory regarding GRU intrusion set Sandworm. Retrieved June 10, 2020.
  3. UK NCSC. (2020, October 19). UK exposes series of Russian cyber attacks against Olympic and Paralympic Games . Retrieved November 30, 2020.
  4. Secureworks. (2020, May 1). IRON VIKING Threat Profile. Retrieved June 10, 2020.
  5. Haquebord, F. et al. (2022, March 17). Cyclops Blink Sets Sights on Asus Routers. Retrieved March 17, 2022.
  6. Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.