Log in Request a demo

Malware profile

NotPetya

Also known as ExPetr, Diskcoder.C, Petrwrap

NotPetya is destructive malware that looks like ransomware.

In short

NotPetya is destructive malware that looks like ransomware. MITRE says the attackers never intended the encrypted data to be recoverable, so it is better thought of as a wiper. It spread across networks from 27 June 2017 and has been attributed by the UK, the US and others to the Russian military.

Last updated 9 October 2026

Profile MapMalware
  1. Names6names in public reportsNotPetya · ExPetr · Diskcoder.C
  2. Techniques13ATT&CK techniques listedCredential Access · Lateral Movement · Stealth
  3. Infection Steps5in the delivery chainUpdate server abused · Traffic rerouted
  4. Linked Groups1groups that use itSandworm

In one minute

What it is
Malware that looks like ransomware but destroys data. MITRE says its main purpose was to destroy data and disk structures.
What it does
Encrypts files and disk structures, spreads inside networks with stolen credentials and SMBv1 exploits, then reboots the machine.
Who uses it
Attributed by the UK government on 15 February 2018 and, per CISA, by the US Government to the Russian military. Charged by the US Department of Justice in October 2020, to Russian military intelligence (GRU Unit 74455), which MITRE tracks as Sandworm Team.
How it gets in
Per the US indictment and CISA, delivered through the Ukrainian accounting software M.E.Doc, then spread inside networks.
What to do first
Confirm the March 2017 Microsoft patch for MS17-010 is applied and disable SMBv1, as CISA advises.

What it does

NotPetya shows a ransom note and asks for bitcoin, but CISA found no evidence of a link between the encryption key and the victim ID, so paying may not restore files. The US indictment calls the ransomware purpose a ruse.

It also spread beyond its main targets in Ukraine. The UK government said its indiscriminate design caused it to affect other European and Russian businesses.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
NotPetyaMITRE ATT&CK S0368; CISA alert TA17-181A; US indictment of October 2020[1, 2, 3]
ExPetrMITRE ATT&CK Associated Software[1]
Diskcoder.CMITRE ATT&CK Associated Software[1]
GoldenEyeMITRE ATT&CK Associated Software[1]
PetrwrapMITRE ATT&CK Associated Software[1]
NyetyaMITRE ATT&CK Associated Software[1]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Credential Access

  • OS Credential Dumping: LSASS Memory T1003.001

    Contains a modified Mimikatz that gathers credentials, which are then used to move to other systems.[1, 2]

Lateral Movement

  • Remote Services: SMB/Windows Admin Shares T1021.002

    Can use PsExec, which works through the ADMIN$ share, to run commands on remote systems.[1]

  • Exploitation of Remote Services T1210

    Uses the SMBv1 exploits EternalBlue and EternalRomance to reach other systems on the network.[1, 2, 3]

Stealth

  • Masquerading T1036

    Drops PsExec under the file name dllhost.dat.[1]

  • System Binary Proxy Execution: Rundll32 T1218.011

    Uses rundll32.exe to install itself on remote systems reached through PsExec or wmic.[1]

Execution

  • Windows Management Instrumentation T1047

    Can use wmic to help spread across a network.[1, 2]

  • Scheduled Task/Job: Scheduled Task T1053.005

    Creates a task that reboots the system one hour after infection.[1]

  • System Services: Service Execution T1569.002

    Can use PsExec to help spread across a network.[1, 2]

Discovery

  • File and Directory Discovery T1083

    Looks for files with dozens of different extensions before encrypting them.[1, 3]

  • Software Discovery: Security Software Discovery T1518.001

    Checks whether specific antivirus programs are running on the infected host.[1, 3]

Impact

  • Data Encrypted for Impact T1486

    Encrypts user files and disk structures such as the MBR with 2048-bit RSA.[1, 2, 3]

  • System Shutdown/Reboot T1529

    Reboots the system one hour after infection.[1, 3]

Defense Impairment

  • Disable or Modify Tools: Clear Windows Event Logs T1685.005

    Uses wevtutil to clear the Windows event logs.[1, 3]

How it spreads

CISA describes four ways NotPetya moved inside a network: stolen Windows credentials used with WMIC or PsExec, and the SMBv1 exploits EternalBlue and EternalRomance. The US indictment says the malware reached victims in June 2017 through update traffic for the Ukrainian accounting software M.E.Doc, which the attackers rerouted to a server they controlled. CISA names the same software as the delivery mechanism and says organizations should treat systems with M.E.Doc installed as suspicious.

How an infection runs

The order of steps in a typical infection, as the sources describe it.

  1. Update server abused

    The US indictment says the attackers had the M.E.Doc code and changed update files, the first on or about 14 April 2017 and another on or about 21 June 2017.[3]

  2. Traffic rerouted

    On 27 June 2017 the attackers rerouted update traffic from the M.E.Doc update server to a France-based server they controlled, which delivered the malware.[3]

  3. Checks and credentials

    The malware tried to raise its privileges, checked for antivirus processes and looked for other computers on the network. CISA says it used a modified Mimikatz to steal Windows credentials.[2, 3]

  4. Spread inside the network

    It used the stolen credentials with WMIC or PsExec, or the EternalBlue and EternalRomance exploits against unpatched SMBv1 systems.[2, 3]

  5. Encryption and reboot

    It encrypted files, left a ransom note, changed the MBR and restarted the computer.[2, 3]

Timeline

  1. March 14, 2017

    Microsoft patch for MS17-010

    Microsoft released a security update for the SMB vulnerability that covers the EternalBlue and EternalRomance techniques, per CISA.[2]

  2. April 14, 2017

    First malicious M.E.Doc update

    The US indictment says the first malicious update file was published to the M.E.Doc update server on or about this date.[3]

  3. June 21, 2017

    Second malicious update

    The indictment says an update file that would deliver NotPetya was published to the update server.[3]

  4. June 27, 2017

    Worldwide attack

    MITRE dates the worldwide NotPetya attack from this day. CISA says it was notified of Petya malware events in several countries and sectors.[1, 2]

  5. July 1, 2017

    CISA alert issued

    CISA published the first version of alert TA17-181A.[2]

  6. February 15, 2018

    UK and US attribution

    The UK government attributed NotPetya to the Russian Government, specifically the Russian military. CISA updated its alert the same day to add the attribution of NotPetya to the Russian military. A later UK government profile says the UK attributed the attack to GRU Unit 74455 in 2018.[2, 4, 6]

  7. October 2020

    US indictment

    MITRE says the US indicted six GRU Unit 74455 officers associated with Sandworm Team, including for the 2017 NotPetya attack.[5]

Detection and defense

  1. Apply the SMB patch

    Confirm Microsoft's MS17-010 patch of March 14, 2017 is applied on all systems.[2]

    Counters: T1210

  2. Disable SMBv1 and limit SMB

    Disable SMBv1 and block SMB at the network boundary by blocking TCP port 445 and related ports. CISA warns this may disrupt file sharing, so weigh the effect first.[2]

    Counters: T1210 T1021.002

  3. Block PsExec and limit WMI

    Block remote execution through PsExec, secure WMI by authorizing users and setting permissions, and disable or limit remote WMI and file sharing.[2]

    Counters: T1569.002 T1047 T1021.002

  4. Limit privileged accounts

    Manage privileged accounts and apply least privilege so stolen credentials reach fewer systems.[2]

    Counters: T1003.001 T1078.003

  5. Stop workstation to workstation traffic

    Use host-based firewalls to block workstation-to-workstation communication and segregate networks.[2]

    Counters: T1021.002 T1210

  6. Keep tested backups

    Back up data regularly and test the backups, so recovery is a restore from a known clean copy.[2]

    Counters: T1486 T1529

  7. Use the official detection resources

    CISA alert TA17-181A carries the analysis report MIFR-10130295 (PDF and STIX files), a CSV of indicators and a list of public network rulesets. Share them with your security vendor.[2]

    Counters: T1210 T1486

Questions

Is NotPetya ransomware?

It looks like ransomware, but MITRE says its main purpose was to destroy data and the attackers never intended recovery. CISA says it behaves more like destructive malware than ransomware.

Who is behind NotPetya?

It has been attributed by the UK government (15 February 2018) and, per CISA, the US Government to the Russian military. In October 2020 the US charged six GRU Unit 74455 officers, a unit MITRE tracks as Sandworm Team.

How did NotPetya reach victims?

The US indictment and CISA both name the Ukrainian accounting software M.E.Doc as the delivery route on 27 June 2017.

Should victims pay the ransom?

CISA recommends against paying. In this incident the payment email address was shut down, and the indictment says the attackers could not decrypt files even if the ransom was paid.

How does NotPetya spread inside a network?

CISA lists PsExec, WMI, EternalBlue and EternalRomance. The first and in most cases most effective method used a modified Mimikatz to steal credentials.

In our research

  1. Ransomware examples: attacks, types and groups October 2026
  2. Sandworm (APT44): Russia’s Most Destructive Cyber Weapon November 2025
  3. Geopolitical Countdown: The Evolution of Cyberspace from Espionage to Destruction and New Strategies for Corporate Resilience November 2025
  4. Understanding Supply Chain Attack Tactics with Case Study October 2025
  5. Breaking the Chain: How to Secure Your Supply Chain Against Cyber Risks February 2025
  6. Cracking the Code: How Cyber Threat Intelligence Could Save Your Business October 2024

Sources

  1. NotPetya, Software S0368 MITRE ATT&CKSupports: Names, platform, techniques and the description of NotPetya as a wiper used by Sandworm Team.
  2. Petya Ransomware, Alert TA17-181A CISASupports: Propagation methods, M.E.Doc delivery, mitigations, detection resources and the February 2018 update.
  3. Indictment, United States v. Andrienko and others US Department of Justice, Western District of PennsylvaniaSupports: Charges against GRU Unit 74455 officers, M.E.Doc update route and behaviour of the malware.
  4. Foreign Office Minister condemns Russia for NotPetya attacks UK Foreign and Commonwealth Office and NCSCSupports: UK attribution of NotPetya to the Russian military on 15 February 2018.
  5. Sandworm Team, Group G0034 MITRE ATT&CKSupports: MITRE's account of the October 2020 US indictment of six GRU Unit 74455 officers.
  6. Profile: GRU cyber and hybrid threat operations UK Foreign, Commonwealth and Development Office, Home Office, Cabinet Office and NCSCSupports: UK attribution of NotPetya to Unit 74455 in 2018.

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Wiper malware

Wiper malware is malicious software that destroys data or makes systems unusable by overwriting or deleting files or disk contents.

Read more

Glossary term

Ransomware

Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.

Read more