Episode
24 December 2019 Official episode · Official transcript
advanced persistent threat
The episode examines the 2017 NotPetya destructive worm, its propagation through MeDoc, the use of Mimikatz and EternalBlue, its global impact, and attribution to Russian military-linked operators.
Topics: Destructive malware posing as ransomware, Worm propagation and lateral movement, Windows credential dumping with Mimikatz, SMB exploitation with EternalBlue, Software-update supply-chain compromise through MeDoc, Domain controller and backup destruction, Cyber-war and nation-state attribution, Critical infrastructure and global supply-chain disruption, Windows authentication weaknesses, Incident response and large-scale network recovery
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Andy Greenberg AUTHORED Sandworm
Andy Greenberg says he is the author of the book Sandworm.
Explicit Confidence 99% · Andy Greenberg EP 54 Details
“I’m Andy Greenberg and I’m a senior writer for Wired Magazine and I’m the author of this book, Sandworm.”
Mimikatz DEVELOPED_BY Benjamin Delpy
Benjamin Delpy built Mimikatz to extract usernames and passwords from memory.
Explicit Confidence 99% · Jack Rhysider EP 54 Details
“He built a tool to extract this username and password to display it to anyone who wants to see it. That tool he made is called Mimikatz”
The episode says the hackers used Mimikatz to obtain credentials and help the worm spread through networks.
Explicit Confidence 98% · Jack Rhysider EP 54 Details
“the hackers used a tool called Mimikatz”
NotPetya USES EternalBlue
The worm used EternalBlue as an additional way to enter unpatched computers.
Explicit Confidence 98% · Jack Rhysider EP 54 Details
“another tool was added to this worm, something called EternalBlue”
EternalBlue EXPLOITS SMB vulnerability
EternalBlue exploited a vulnerability in the Server Message Block function.
Explicit Confidence 99% · Andy Greenberg EP 54 Details
“EternalBlue which exploited a vulnerability in a Windows function called Server Message Block”
SMB vulnerability AFFECTS Server Message Block
The vulnerability EternalBlue exploited was in the Windows Server Message Block function.
Explicit Confidence 99% · Andy Greenberg EP 54 Details
“EternalBlue which exploited a vulnerability in a Windows function called Server Message Block”
NotPetya INVOLVES EternalBlue
The episode describes EternalBlue being used by the NotPetya worm to spread to computers without stolen passwords.
Explicit Confidence 99% · Jack Rhysider EP 54 Details
“if it couldn’t login like that, it would then try to use EternalBlue to see if that system was unpatched and exploit it that way”
NotPetya was initially thought to be Petya, but further research identified it as a new strain; the name NotPetya stuck.
Explicit Confidence 99% · Jack Rhysider EP 54 Details
“It was originally thought to be Petya but some additional research went into it and found this is a new strain. It was not Petya.”
NotPetya USES ransomware
The episode says ransomware was used as the destructive mechanism, even though the attackers were not believed to be seeking money.
Explicit Confidence 98% · Jack Rhysider EP 54 Details
“Their goal was to destroy computers and ransomware was just the perfect tool to do that.”
The stated target was Ukraine, including its businesses and government agencies, with the goal of taking down as many Ukrainian computers as possible.
Explicit Confidence 99% · Jack Rhysider EP 54 Details
“the target of this attack was Ukraine and the goal was to take out as many computers as possible in Ukraine; businesses, government agencies, doesn’t matter.”
NotPetya TARGETS Linkos Group
The attackers selected Linkos Group and its MeDoc update infrastructure as the initial point for targeting Ukraine.
Explicit Confidence 96% · Jack Rhysider EP 54 Details
“They ultimately chose to target a small company called Linkos Group.”
NotPetya was distributed by hijacking MeDoc's update mechanism and pushing malware through it.
Explicit Confidence 99% · Andy Greenberg EP 54 Details
“they hijacked MeDoc’s update mechanism to push out their own malware. Everyone everywhere in the world who had MeDoc installed suddenly has NotPetya”
NotPetya INVOLVES supply-chain compromise
The incident used a supply-chain compromise involving the MeDoc software update mechanism.
Derived Confidence 96% · Andy Greenberg EP 54 Details
“they hijacked MeDoc’s update mechanism to push out their own malware”
NotPetya TARGETS Oschadbank
NotPetya hit approximately ninety percent of Oschadbank's computers and shut down its systems.
Explicit Confidence 98% · Andy Greenberg EP 54 Details
“Around ninety percent of all of the computers in Oschadbank had been hit with this mysterious ransomware worm.”
NotPetya infected and severely disrupted Maersk's global network and operations.
Explicit Confidence 99% · Andy Greenberg EP 54 Details
“That was all that it took for Maersk’s entire global network to be infected.”
FedEx was among the western companies hit by NotPetya.
Explicit Confidence 98% · Andy Greenberg EP 54 Details
“That included FedEx, Maersk, the world’s largest [00:20:00] shipping firm, Merck”
Merck was among the multinational companies infected by NotPetya.
Explicit Confidence 98% · Andy Greenberg EP 54 Details
“That included FedEx, Maersk, the world’s largest [00:20:00] shipping firm, Merck”
NotPetya ATTRIBUTED_TO Sandworm
ESET's forensic evidence tied NotPetya to earlier attacks against Ukraine that had been tied to Sandworm.
Attributed Confidence 91% · Andy Greenberg EP 54 Details
“ESET had started to pull together forensic evidence that tied NotPetya to the earlier waves of attacks against Ukraine”
“Those attacks, in turn, had been tied to this group Sandworm.”
The White House and the other Five Eyes intelligence agencies publicly attributed NotPetya to Russia, specifically saying it was deployed by the Russian military against Ukraine.
Attributed Confidence 99% · Andy Greenberg EP 54 Details
“the White House put out a statement, a very, very short statement that just said yes, NotPetya was the worst cyber-attack in history and it was deployed by the Russian military against Ukraine”
“The US, Canada, New Zealand, Australia, and the UK all simultaneously called out Russia as the perpetrator of NotPetya.”
The Washington Post was credited with reporting before the official announcement that NotPetya was carried out by the GRU.
Attributed Confidence 90% · Andy Greenberg EP 54 Details
“the Washington Post who, in a story before that announcement, said simply that NotPetya was carried out by the GRU.”
Sandworm POSSIBLY_SAME_AS Fancy Bear
The episode presents Sandworm and Fancy Bear as possibly the same group, but explicitly says this is not known.
Uncertain Confidence 98% · Jack Rhysider EP 54 Details
“It might be the same group as Fancy Bear. We don’t know.”
The episode presents the belief that Sandworm and Fancy Bear were hacking groups working for Russia's GRU, while acknowledging uncertainty about the exact relationship.
Uncertain Confidence 85% · Jack Rhysider EP 54 Details
“what we believe is that both Sandworm and Fancy Bear are hacking groups both working for Russia’s GRU in Moscow.”
Incident responders and security researchers characterized NotPetya as a destructive wiper posing as ransomware rather than genuine ransomware.
Explicit Confidence 98% · Andy Greenberg EP 54 Details
“It was a destructive worm posing as ransomware.”
“security researchers were suggesting that this isn’t a ransomware; it’s a wiper”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-12T17:16:13.211741+00:00