NotPetya Destructive Cyberattack (Jun 27 2017)

Introduction

On 27 June 2017, a destructive malware campaign now known as NotPetya began detonating across Ukraine and rapidly spread to multinational corporations worldwide. Initial reporting described it as ransomware — it displayed a ransom note demanding Bitcoin — but forensic analysis by ESET, Cisco Talos, and other firms quickly established that it had no functional decryption mechanism. It was not ransomware. It was a wiper: a weapon designed solely to destroy data and render machines unbootable.

The attack is attributed by US, UK, EU, and Australian governments to Russian GRU Unit 74455, known publicly as Sandworm. The US Department of Justice indicted six GRU officers in October 2020 by name.

The Supply-Chain Entry Point

NotPetya entered corporate networks via a trojanised software update to M.E.Doc (Me.Doc), a Ukrainian tax reporting and accounting package used by approximately 80 percent of Ukrainian businesses. The attackers had compromised M.E.Doc''s update servers weeks before the outbreak date and seeded a backdoored update to legitimate customers. This supply-chain mechanism meant that organizations with no direct relationship with the attackers received the malware through a trusted software channel — a technique later mirrored in the 2020 SolarWinds attack.

Propagation Mechanisms

Once inside a network, NotPetya used two complementary propagation tools. EternalBlue — an NSA exploit leaked by the Shadow Brokers in April 2017 and already used in the WannaCry attack of May 2017 — exploited the SMBv1 vulnerability (MS17-010) to move laterally across Windows networks. Mimikatz, an open-source credential-harvesting tool, extracted Windows login credentials from memory, allowing NotPetya to authenticate to additional machines using legitimate administrator accounts. The combination made it devastating even in environments that had partially patched EternalBlue: credentials harvested from one unpatched machine could authenticate to fully patched systems.

Global Damage

The estimated global economic damage from NotPetya exceeds $10 billion. Major victims include Maersk ($300M, which lost almost all of its Active Directory infrastructure and had to reinstall 45,000 PCs and 4,000 servers in ten days), Merck ($870M, affecting pharmaceutical manufacturing and vaccine production), FedEx/TNT ($400M, including permanent loss of some legacy systems), Mondelèz ($100M), and Saint-Gobain (€220M). Ukraine itself suffered widespread disruption to government systems, banks, media, and infrastructure.

Attribution and Legal Accountability

In February 2018, the US Cybersecurity and Infrastructure Security Agency (CISA), the UK National Cyber Security Centre (NCSC), and Five Eyes partners jointly attributed NotPetya to the Russian GRU. In October 2020, the US DOJ unsealed an indictment of six GRU Unit 74455 officers: Yuriy Andrienko, Sergei Detistov, Pavel Frolov, Artem Ochichenko, Petr Pliskin, and Anatoliy Kovalev. The indictment detailed the technical operation with granular specificity, drawing on intercepted communications and forensic evidence.

Insurance War-Exclusion Litigation

Mondelèz International sued its insurer Zurich Insurance after Zurich denied its $100M NotPetya claim under a war exclusion clause, arguing the attack constituted a "hostile or warlike action" by a sovereign state. The case attracted widespread attention from the insurance industry because its outcome would determine whether cyber incidents attributed to nation-states would be systematically excluded from commercial property coverage. The case was settled in 2022 on undisclosed terms. Subsequent years have seen Lloyd''s of London and other insurers introduce explicit state-sponsored cyberattack exclusions in cyber policies.

Verdict

NotPetya is a confirmed nation-state cyberweapon. The attribution is corroborated by multiple independent government assessments, forensic analysis from multiple private-sector firms, and a detailed criminal indictment. The claim that it was a Russian GRU operation targeting Ukraine — with collateral damage to global commerce — is not a theory: it is the documented conclusion of allied intelligence and law enforcement.

Why Forensic Analysts Concluded This Was Sabotage, Not Extortion

Days after the outbreak, Kaspersky researcher Anton Ivanov and colleagues dissected the ransom mechanism itself and found it could not have worked even in principle. Genuine Petya, the 2016 ransomware family NotPetya impersonated, generated an "installation ID" that encoded real data the attacker could use to reconstruct a victim's decryption key. NotPetya's version instead produced that ID using Windows' CryptGenRandom function — pure random data with no mathematical relationship to the key actually used to scramble the machine's Master File Table. A victim who located a working payment channel, paid the full ransom, and sent the ID exactly as instructed would still receive nothing back, because there was nothing to send: the operator could not extract a real key from garbage.

That payment channel collapsed almost immediately in any case. The ransom note's sole point of contact, [email protected], was hosted by the German provider Posteo, which shut the account down early on the morning of 27 June 2017 — the same day the outbreak began — after it was flagged under routine anti-abuse procedures, before Posteo or anyone else grasped the scale of what was unfolding. From that point on, victims had no way to reach the attacker even to attempt payment. Cisco Talos reached the same "this cannot be ransomware" conclusion independently and within days of Kaspersky, examining the encryption routine rather than the mail server. Two unrelated technical teams, working from different evidence, converged on the same read: the ransom note was theater layered over a data-destruction weapon.

Corroboration Beyond the Five Eyes Statement

The February 2018 joint attribution is often cited as a single event, but the underlying corroboration is broader and came from multiple independent directions. Australia did not simply co-sign the US and UK language: Angus Taylor, then Minister for Law Enforcement and Cyber Security, stated that Australian intelligence agencies had separately assessed — in consultation with, but not solely dependent on, US and UK partners — that Russian state-sponsored actors were responsible, and that the Australian government "condemns Russia's behaviour, which posed grave risks to the global economy." A month later, the US Treasury's Office of Foreign Assets Control went beyond statements: on 15 March 2018 it sanctioned Russian entities and individuals under the Countering America's Adversaries Through Sanctions Act, explicitly naming NotPetya as "the most destructive and costly cyber-attack in history" and tying it directly to the Russian military.

Technical corroboration arrived independently of any government. Kaspersky researchers identified code-level overlaps between the ExPetr wiper and the BlackEnergy/KillDisk toolkit Sandworm had already used against Ukraine's power grid in 2015 and 2016 — matching file-extension target lists and identical shutdown command strings. Kaspersky was explicit that this alone was only a "low confidence, persistent hunch," which is itself informative: the strongest parts of the attribution case (the supply-chain forensics, the indictment's granular detail) never needed to lean on this weaker signal, and the honesty about its limits is a mark of the broader body of evidence's quality. Separately, and requiring no cooperation from Western intelligence at all, Ukrainian cyber police raided M.E.Doc developer Linkos Group on 4 July 2017 and seized servers running four-year-old, unpatched ProFTPD, Nginx, and OpenSSH, with no HTTPS or cryptographic signing anywhere on the update-delivery channel — an independent, on-the-ground confirmation of exactly the supply-chain entry point the West's forensic teams had already mapped.

The Strongest Counter-Argument — and Why It Doesn't Hold

The most substantive objection to "deliberate Russian state operation" is that NotPetya devastated major Russian companies too, including state oil giant Rosneft, Sberbank, Home Credit Bank, miner Evraz, and diagnostics firm Invitro. Skeptics ask why the Kremlin would order an attack that damages its own economy.

The objection doesn't survive contact with how the malware actually worked. NotPetya's propagation logic — EternalBlue plus harvested credentials — checks no flag for nationality; once it moved beyond the initially targeted M.E.Doc-linked Ukrainian networks, it spread through any connected Windows environment indiscriminately, including Russian firms with Ukrainian subsidiaries or shared corporate networks. A weapon can be deliberately aimed at a target and still be recklessly indifferent to where it goes after release; those are not contradictory. Analysts have also noted the pattern is not unprecedented: Russian state operations have tolerated, and at times arguably welcomed, domestic collateral damage as cover for deniability — the Kremlin's own "why would we hit ourselves" framing is precisely the rhetorical use such collateral damage serves. Most importantly, the counter-argument doesn't actually touch the evidentiary chain establishing authorship: the M.E.Doc backdoor, the wiper's technical design, and the DOJ's named-officer indictment describe who built the weapon and how it was launched — questions entirely separate from how far it later spread.

Sanctions, Insurance Precedent, and Lasting Aftermath

Merck's own insurance fight produced something Mondelez's settlement did not: an actual judicial ruling on the "act of war" question, reached on the merits rather than settled away. In January 2022, a New Jersey Superior Court held that the war exclusion in Merck's property policies — which required "hostile or warlike action ... by a government or sovereign power" — did not bar its roughly $1.4 billion NotPetya claim, because the clause's century-old language was written for concerted military action, not state-attributed malware. Insurers appealed, and New Jersey's Appellate Division affirmed Merck's win on 1 May 2023, rejecting the argument that any unfriendly government action qualifies as "hostile." With the case headed to the state Supreme Court, the two sides reached a confidential settlement in early January 2024, days before oral argument — leaving Merck's win as the operative precedent without a final high-court ruling ever being issued.

Accountability also reached the point of entry. Ukrainian officials did not treat Linkos Group solely as a victim of the same attack: a cyber police representative stated the company had been warned repeatedly by antivirus vendors about its server security and "will face criminal responsibility" for the negligence that let the backdoor persist for weeks undetected. Combined with the US Treasury's CAATSA sanctions and the DOJ's 2020 indictment, the response to NotPetya spans criminal prosecution of the alleged operators, sanctions on the state apparatus behind them, and legal accountability for the compromised software vendor whose negligence provided the door — a rare case where nearly every link in a cyberattack's chain faced some form of formal consequence.