NotPetya: The 2017 Attack That Cost Companies Billions

On 27 June 2017, computers in Ukraine began showing a ransom message and then stopped working. Within hours the malware, later known as NotPetya, had spread to companies across the world, shutting down shipping terminals, factories, pharmaceutical operations and offices. It looked like ransomware, but it was designed to destroy data. It is often described as one of the most costly cyberattacks in history.

A poisoned update

The malware first reached victims through a software update. M.E.Doc is an accounting program widely used by Ukrainian businesses for tax reporting. Attackers had compromised the software company's update system, and a legitimate-looking update delivered the malicious code to customers. Any company with a Ukrainian subsidiary that used the software was at risk, whether or not it was based in Ukraine. This made it a supply chain attack, in which the victim is reached through a trusted supplier.

How it spread inside networks

Once inside a network, NotPetya was highly effective. It used the EternalBlue exploit, which was also behind WannaCry, to move to unpatched Windows machines. It also collected passwords from the memory of infected computers with a credential-stealing tool, and then used Windows administration features to log in to other machines using those passwords. Even machines that had been patched could be reached if an administrator's credentials were in memory.

Ransomware that could not give files back

NotPetya displayed a message demanding 300 US dollars in bitcoin, but security researchers quickly found that the payment system could not work: the contact email address was shut down, and the encryption was designed so that the data could not be recovered even by the attackers. It was in effect a wiper disguised as ransomware. In February 2018 the US and UK governments attributed the attack to the Russian military, and the White House described it as the most destructive and costly cyberattack in history. A former White House official later put total damages at more than 10 billion dollars. Russia denied involvement.

The Maersk story

The Danish shipping giant Maersk became the best-known victim. The company said the attack hit its systems globally, disrupted operations at port terminals and forced it to reinstall thousands of servers and computers. Its chairman later stated publicly that it reinstalled around 4,000 servers and 45,000 PCs and rebuilt about 2,500 applications within about ten days, and the company put the financial impact at between 200 and 300 million US dollars.

Journalist Andy Greenberg reported that a single domain controller in Ghana survived because a power cut had taken it offline, and its copy of the network's directory was used to restore the rest. The point holds either way: Maersk recovered because one clean copy of a crucial system had survived.

Other well-known companies hit included the pharmaceutical firm Merck, the food company Mondelez, the building materials company Saint-Gobain and the delivery company TNT Express, owned by FedEx.

What made it so destructive

• Trusted channel. The malware arrived as an update from a normal supplier.
• Lateral movement. One infected computer led to many.
• Shared admin credentials. Reused administrator passwords made it easy to jump between machines.
• Destruction as a goal. Paying a ransom would not help.

Why a supply chain attack is hard to see coming

With most attacks, you can ask whether a message or file looks suspicious. With a poisoned update, there is nothing suspicious to see. The update arrives from a vendor your systems trust, signed or delivered through the normal channel, and your own processes tell you to install it. The defender's options are therefore different: limit what any single piece of software can do, watch for unusual behaviour after an update and keep the ability to roll back.

Security researchers later reported that the M.E.Doc update system had been compromised earlier in 2017, before the NotPetya outbreak itself. The incident prompted many companies to review software from small suppliers and to ask which third-party tools had permission to update themselves automatically.

The insurance industry also noticed: some insurers had to decide whether an attack attributed to a state counted as an act of war, which many policies exclude. The dispute between Mondelez and its insurer over this question was reported in the press and became a landmark discussion in cyber insurance.

The practical lesson for site owners

Updates are essential, but they come from suppliers you have to trust, so keep your list of plugins, themes and tools short and take them from reputable sources. Do not reuse administrator passwords across systems, and give accounts only the access they need. Above all, keep backups that are isolated from the systems they protect, since an attack designed to destroy cannot be cured by a payment.

Our VPS plans give you the control to separate environments for different projects, and our security page summarises what we offer. For help planning backups, see the knowledge base.