Incident
incident:notpetya
The 2017 cyber-attack that began in Ukraine and caused widespread disruption to government agencies, companies, and critical services worldwide.
The 2017 cyber-attack that began in Ukraine and caused widespread disruption to government agencies, companies, and critical services worldwide.
“NotPetya happens, this biggest cyber-attack in history.”
“The estimated damages from this attack totaled ten billion dollars.”
The June 2017 attack on Ukraine mentioned as a major incident following WannaCry.
“NotPetya hit Ukraine”
Major cyberattack against Ukraine described as causing widespread network disruption and later attributed in the episode to the same group as Olympic Destroyer.
“NotPetya was a major cyber-attack waged on Ukraine”
“If that’s the case, it meant this was the same group that conducted NotPetya”
Attack described as disrupting FedEx, Merck vaccine production, Chernobyl radiation monitoring, and other production facilities.
“a NotPetya attack which cost FedEx $400 million and decimated vaccine production lines at Merck”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | EternalBlue | Explicit | 54 |
| outgoing | TARGETS | Linkos Group | Explicit | 54 |
| outgoing | INVOLVES | supply-chain compromise | Derived | 54 |
| outgoing | INVOLVES | NotPetya | Explicit | 73 |
NotPetya INVOLVES EternalBlue
The episode describes EternalBlue being used by the NotPetya worm to spread to computers without stolen passwords.
Explicit Confidence 99% · Jack Rhysider EP 54 Details
“if it couldn’t login like that, it would then try to use EternalBlue to see if that system was unpatched and exploit it that way”
NotPetya TARGETS Linkos Group
The attackers selected Linkos Group and its MeDoc update infrastructure as the initial point for targeting Ukraine.
Explicit Confidence 96% · Jack Rhysider EP 54 Details
“They ultimately chose to target a small company called Linkos Group.”
NotPetya INVOLVES supply-chain compromise
The incident used a supply-chain compromise involving the MeDoc software update mechanism.
Derived Confidence 96% · Andy Greenberg EP 54 Details
“they hijacked MeDoc’s update mechanism to push out their own malware”
The NotPetya incident involved the NotPetya malware.
Explicit Confidence 98% · Jack Rhysider EP 73 Details
“when NotPetya hit Ukraine”