The episode says the hackers used Mimikatz to obtain credentials and help the worm spread through networks.
Explicit Confidence 98% · Jack Rhysider EP 54 Details
“the hackers used a tool called Mimikatz”
Malware
malware:notpetya
A destructive worm presented as ransomware that spread through MeDoc and encrypted or rendered systems unusable.
A destructive worm presented as ransomware that spread through MeDoc and encrypted or rendered systems unusable.
“This would become known as the NotPetya attack on Ukraine.”
“It was a destructive worm posing as ransomware.”
Malware or attack activity cited as an example of an attack against civilian infrastructure.
“the attack like NotPetya”
Malware mentioned as having hit Ukraine after WannaCry and also using EternalBlue.
“in June, is when NotPetya hit Ukraine which also used EternalBlue”
Destructive worm discussed as resembling Olympic Destroyer and as having been released in Ukraine.
“NotPetya and Bad Rabbit, both of which were these worms released in Ukraine”
“the NotPetya malware”
Malware used in an attack after an NSA-held exploit was publicly dumped, causing extensive operational and economic disruption.
“It was used in a NotPetya attack which cost FedEx $400 million”
Malware incident used as a comparison for the scale of the Kaseya supply-chain attack.
“one of the biggest supply chain incidents since NotPetya”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | Mimikatz | Explicit | 54 |
| outgoing | USES | EternalBlue | Explicit | 54 |
| outgoing | USES | EternalBlue | Explicit | 73 |
| outgoing | VARIANT_OF | Petya | Explicit | 54 |
| outgoing | USES | ransomware | Explicit | 54 |
| outgoing | TARGETS | Ukraine | Explicit | 54 |
| outgoing | USES | MeDoc | Explicit | 54 |
| outgoing | TARGETS | Oschadbank | Explicit | 54 |
| outgoing | TARGETS | Maersk | Explicit | 54 |
| outgoing | TARGETS | FedEx | Explicit | 54 |
| outgoing | TARGETS | Merck | Explicit | 54 |
| outgoing | ATTRIBUTED_TO | Sandworm | Attributed | 54 |
| outgoing | ATTRIBUTED_TO | Russia | Attributed | 54 |
| outgoing | ATTRIBUTED_TO | GRU | Attributed | 54 |
| outgoing | RELATED_TO | wiper | Explicit | 54 |
| outgoing | USES | zero-day exploit | Explicit | 98 |
| incoming | INVOLVES | NotPetya | Explicit | 73 |
The episode says the hackers used Mimikatz to obtain credentials and help the worm spread through networks.
Explicit Confidence 98% · Jack Rhysider EP 54 Details
“the hackers used a tool called Mimikatz”
NotPetya USES EternalBlue
The worm used EternalBlue as an additional way to enter unpatched computers.
Explicit Confidence 98% · Jack Rhysider EP 54 Details
“another tool was added to this worm, something called EternalBlue”
NotPetya was initially thought to be Petya, but further research identified it as a new strain; the name NotPetya stuck.
Explicit Confidence 99% · Jack Rhysider EP 54 Details
“It was originally thought to be Petya but some additional research went into it and found this is a new strain. It was not Petya.”
NotPetya USES ransomware
The episode says ransomware was used as the destructive mechanism, even though the attackers were not believed to be seeking money.
Explicit Confidence 98% · Jack Rhysider EP 54 Details
“Their goal was to destroy computers and ransomware was just the perfect tool to do that.”
The stated target was Ukraine, including its businesses and government agencies, with the goal of taking down as many Ukrainian computers as possible.
Explicit Confidence 99% · Jack Rhysider EP 54 Details
“the target of this attack was Ukraine and the goal was to take out as many computers as possible in Ukraine; businesses, government agencies, doesn’t matter.”
NotPetya was distributed by hijacking MeDoc's update mechanism and pushing malware through it.
Explicit Confidence 99% · Andy Greenberg EP 54 Details
“they hijacked MeDoc’s update mechanism to push out their own malware. Everyone everywhere in the world who had MeDoc installed suddenly has NotPetya”
NotPetya TARGETS Oschadbank
NotPetya hit approximately ninety percent of Oschadbank's computers and shut down its systems.
Explicit Confidence 98% · Andy Greenberg EP 54 Details
“Around ninety percent of all of the computers in Oschadbank had been hit with this mysterious ransomware worm.”
NotPetya infected and severely disrupted Maersk's global network and operations.
Explicit Confidence 99% · Andy Greenberg EP 54 Details
“That was all that it took for Maersk’s entire global network to be infected.”
FedEx was among the western companies hit by NotPetya.
Explicit Confidence 98% · Andy Greenberg EP 54 Details
“That included FedEx, Maersk, the world’s largest [00:20:00] shipping firm, Merck”
Merck was among the multinational companies infected by NotPetya.
Explicit Confidence 98% · Andy Greenberg EP 54 Details
“That included FedEx, Maersk, the world’s largest [00:20:00] shipping firm, Merck”
NotPetya ATTRIBUTED_TO Sandworm
ESET's forensic evidence tied NotPetya to earlier attacks against Ukraine that had been tied to Sandworm.
Attributed Confidence 91% · Andy Greenberg EP 54 Details
“ESET had started to pull together forensic evidence that tied NotPetya to the earlier waves of attacks against Ukraine”
“Those attacks, in turn, had been tied to this group Sandworm.”
The White House and the other Five Eyes intelligence agencies publicly attributed NotPetya to Russia, specifically saying it was deployed by the Russian military against Ukraine.
Attributed Confidence 99% · Andy Greenberg EP 54 Details
“the White House put out a statement, a very, very short statement that just said yes, NotPetya was the worst cyber-attack in history and it was deployed by the Russian military against Ukraine”
“The US, Canada, New Zealand, Australia, and the UK all simultaneously called out Russia as the perpetrator of NotPetya.”
The Washington Post was credited with reporting before the official announcement that NotPetya was carried out by the GRU.
Attributed Confidence 90% · Andy Greenberg EP 54 Details
“the Washington Post who, in a story before that announcement, said simply that NotPetya was carried out by the GRU.”
Incident responders and security researchers characterized NotPetya as a destructive wiper posing as ransomware rather than genuine ransomware.
Explicit Confidence 98% · Andy Greenberg EP 54 Details
“It was a destructive worm posing as ransomware.”
“security researchers were suggesting that this isn’t a ransomware; it’s a wiper”
NotPetya USES EternalBlue
The episode says NotPetya also used EternalBlue.
Explicit Confidence 98% · Jack Rhysider EP 73 Details
“in June, is when NotPetya hit Ukraine which also used EternalBlue”
The NotPetya incident involved the NotPetya malware.
Explicit Confidence 98% · Jack Rhysider EP 73 Details
“when NotPetya hit Ukraine”
NotPetya USES zero-day exploit
The NotPetya attack used the exploit code that had been held by the NSA and later dumped online by the Shadowbrokers.
Explicit Confidence 94% · Nicole Perlroth EP 98 Details
“It was used in a NotPetya attack”