Log in Request a demo

Significant cyber incident

NotPetya outbreak

Also known as NotPetya

NotPetya was a destructive outbreak that began in Ukraine on 27 June 2017.

In short

NotPetya was a destructive outbreak that began in Ukraine on 27 June 2017. It looked like ransomware, but the data could not be recovered. CISA's alert described it spreading through PsExec, WMI and the EternalBlue and EternalRomance exploits, and advised against paying.

Last updated October 2026

What happened

The outbreak began in Ukraine through a compromised update of the M.E.Doc accounting software. It then spread inside networks using the EternalBlue exploit and stolen credentials.

The malware looked like ransomware, but the data could not be recovered.

Timeline

  1. 14 March 2017

    Microsoft releases patch MS17-010 for the SMBv1 flaws, according to CISA.

  2. 14 April 2017

    Threat actors compromise the M.E.Doc development environment, as far back as this date, according to CISA.

  3. 27 June 2017

    The outbreak began in Ukraine through a compromised update of the M.E.Doc accounting software.

  4. June 2017

    It spread inside networks using the EternalBlue exploit and stolen credentials.

  5. 15 February 2018

    The UK government attributed the attack to the Russian military, in a statement dated 15 February 2018.

How the attack worked

Entry point: a software update

CISA says the delivery mechanism on 27 June 2017 was the Ukrainian tax accounting software M.E.Doc. It says the threat actors used a backdoor to compromise the M.E.Doc development environment as far back as 14 April 2017.

Spreading inside a network

CISA lists four methods: PsExec, WMI, and the EternalBlue and EternalRomance exploits for SMBv1. It says the first method, and in most cases the most effective, used a modified version of the Mimikatz tool to steal the user’s Windows credentials. MITRE adds that the malware drops PsExec as dllhost.dat and can clear Windows event logs with wevtutil.

Damage to the machine

CISA says NotPetya modifies the master boot record (MBR) to enable encryption of the master file table (MFT). MITRE says it encrypts user files and disk structures with 2048-bit RSA and reboots the system one hour after infection.

Why it only looked like ransomware

CISA says the victim’s files were encrypted with a dynamically generated 128-bit key and that there was no evidence of a relationship between that key and the victim’s ID. The email address for payment validation was shut down by the email provider.

MITRE ATT&CK techniques listed for NotPetya

T1486 Data Encrypted for Impact, T1210 Exploitation of Remote Services, T1003.001 LSASS Memory, T1021.002 SMB/Windows Admin Shares, T1569.002 Service Execution, T1047 Windows Management Instrumentation, T1036 Masquerading, T1083 File and Directory Discovery, T1529 System Shutdown/Reboot, T1053.005 Scheduled Task.

Impact

CISA says, according to multiple reports, the campaign infected organizations in several sectors, including finance, transportation, energy, commercial facilities, and healthcare. The alert gives no victim count and no loss figure.

The UK Foreign Office statement of 15 February 2018 says the primary targets were Ukrainian financial, energy and government sectors, and that the design of the malware caused it to spread further, affecting other European and Russian business.

Government and regulator response

CISA advised applying the Microsoft patch MS17-010, keeping tested backups, using least privilege, disabling SMBv1 and blocking TCP port 445, and disabling or limiting remote WMI and file sharing. Because the payment email was shut down, paying was unlikely to recover files.

On 15 February 2018 the UK government judged that the Russian Government, specifically the Russian military, was responsible.

Lessons

  1. Patch the flaws that let malware spread

    CISA pointed to Microsoft patch MS17-010, released on 14 March 2017, for the SMBv1 flaws NotPetya used.

  2. Keep backups and test recovery

    Paying may not bring files back, so CISA advised regular backups and tested recovery.

  3. Limit movement inside the network

    CISA advised segregating networks, limiting lateral communication and disabling SMBv1 and remote WMI where they are not needed.

  4. A trusted update path is an attack path

    The first infections came through update delivery of accounting software, not a phishing mail. CISA says its development environment had been compromised for over two months.

What to check in your own organization

  1. Confirm MS17-010 is installed on every Windows system

    CISA says Microsoft released this patch on 14 March 2017, more than three months before the outbreak.

  2. Block SMBv1 and TCP port 445 where they are not needed

    These were the paths for the EternalBlue and EternalRomance exploits, per CISA.

  3. Limit what one stolen login can reach

    CISA lists least privilege and limiting remote WMI and file sharing, because the malware reused stolen credentials.

  4. Test a restore, not just the backup job

    CISA advises regular backups and testing them, since the files could not be recovered by paying.

Questions

Was NotPetya really ransomware?

It looked like ransomware, but CISA said there is no evidence of a relationship between the encryption key and the victim's ID. It may not be possible to decrypt files even if the ransom is paid.

How did NotPetya spread inside networks?

CISA lists PsExec, WMI and the EternalBlue and EternalRomance SMBv1 exploits. It also used a modified Mimikatz tool to steal credentials and reach other systems.

What did CISA recommend against it?

Apply the Microsoft patch MS17-010, keep tested backups, use least privilege, disable or block SMBv1 and TCP port 445, segregate networks and use host-based firewalls.

How did NotPetya first reach victims?

CISA says the delivery mechanism on 27 June 2017 was the Ukrainian tax accounting software M.E.Doc, whose development environment had been compromised as far back as 14 April 2017.

Who was behind NotPetya?

The UK government said on 15 February 2018 that the Russian Government, specifically the Russian military, was responsible. That is an attribution by the UK government.

Which sectors were hit?

CISA cites reports of infections in finance, transportation, energy, commercial facilities and healthcare. The UK says the primary targets were Ukrainian financial, energy and government sectors.

In our research

  1. Ransomware examples: attacks, types and groups October 2026
  2. Geopolitical Countdown: The Evolution of Cyberspace from Espionage to Destruction and New Strategies for Corporate Resilience November 2025
  3. Understanding Supply Chain Attack Tactics with Case Study October 2025
  4. Breaking the Chain: How to Secure Your Supply Chain Against Cyber Risks February 2025
  5. Cyber Resilience 101: Are You Ready for the Next Big Attack? October 2024
  6. Sandworm Threat group

Sources

  1. Alert (TA17-181A): Petya Ransomware CISA
  2. NotPetya, Software S0368 | MITRE ATT&CK MITRE
  3. Foreign Office Minister condemns Russia for NotPetya attacks UK Government (GOV.UK)

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Ransomware

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Read more

Glossary term

Threat actor

A threat actor is an individual or a group that poses a threat to an organization or system.

Read more