{"data":{"case":{"actions":{"de":["Installiere **MS17-010** oder ein späteres Windows-Update auf jedem Computer. Schalte **SMB Version 1** ab.","Verwende nicht dasselbe Administratorpasswort auf vielen Computern: NotPetya verbreitete sich mit gestohlenen Passwörtern, was kein Patch verhindert.","Falls noch eine alte M.E.Doc-Installation vorhanden ist, entferne die Versionen 10.01.175–10.01.176, 10.01.180–10.01.181 und 10.01.188–10.01.189: Sie enthielten die Hintertür."],"en":["Install **MS17-010** or any later Windows update on every computer. Switch off **SMB version 1**.","Do not use the same administrator password on many computers: NotPetya spread with stolen passwords, which no patch prevents.","If an old M.E.Doc installation is still around, remove versions 10.01.175–10.01.176, 10.01.180–10.01.181 and 10.01.188–10.01.189: they carried the backdoor."]},"criteria":{"damage":{"de":"Die US-Regierung beziffert den Schaden in Europa, Asien und Amerika auf Milliarden US-Dollar (Weißes Haus). Allein Maersk rechnete mit 200–300 Millionen US-Dollar (Reuters, Pressebericht).","en":"The US government puts the damage at billions of dollars across Europe, Asia and the Americas (White House). Maersk alone expected USD 200–300 million (Reuters, press report).","met":true},"exploitation":{"de":"NotPetya verbreitete sich selbstständig durch Netzwerke und traf allein in der Ukraine über 2.000 Unternehmen (ukrainische Cyberpolizei über Cisco Talos).","en":"NotPetya spread through networks on its own and hit over 2,000 companies in Ukraine alone (Ukraine's Cyber Police via Cisco Talos).","met":true},"reach":{"de":"Die gemessenen Zahlen bleiben unter der Schwelle. Microsoft zählte mehr als 12.500 Rechner in der Ukraine und Infektionen in 64 weiteren Ländern (Microsoft). Getroffen wurden über 2.000 Unternehmen in der Ukraine (ukrainische Cyberpolizei über Cisco Talos).","en":"Measured counts stay below the threshold. Microsoft counted more than 12,500 machines in Ukraine and infections in 64 more countries (Microsoft). Over 2,000 companies in Ukraine were hit (Ukraine's Cyber Police via Cisco Talos).","met":false},"response":{"de":"Die Regierungen Großbritanniens und der USA machten das russische Militär verantwortlich (britisches Außenministerium; Weißes Haus). Einen Angreifer zu benennen schützt aber niemanden. Über den vorhandenen Patch hinaus ist keine Maßnahme belegt.","en":"The UK and US governments named the Russian military as responsible (UK Foreign Office; White House). But naming an attacker protects no one. No measure beyond the existing patch is documented.","met":false}},"cves":["CVE-2017-0144","CVE-2017-0145"],"cvss":8.8,"cvss_version":"3.1","dates":[{"date":"2017-03-14","key":"patched"},{"date":"2017-04-14","de":"Erstes M.E.Doc-Update mit einer versteckten Hintertür","en":"First M.E.Doc update with a hidden backdoor"},{"date":"2017-06-22","de":"Drittes und letztes M.E.Doc-Update mit der Hintertür","en":"Third and last M.E.Doc update with the backdoor"},{"date":"2017-06-27","key":"outbreak"},{"date":"2018-02-15","de":"Die Regierungen Großbritanniens und der USA machen das russische Militär verantwortlich","en":"The UK and US governments name the Russian military as responsible"}],"de":{"credit":"Analysiert von ESET, Cisco Talos und Microsoft","fixed":"MS17-010 (14. März 2017) für die SMB-Lücken; kein Patch verhindert die Ausbreitung mit gestohlenen Passwörtern. Die Daten ließen sich nicht wiederherstellen","product":"Windows-Netzwerke, erreicht über die ukrainische Buchhaltungssoftware M.E.Doc","summary":"Ein als Ransomware getarnter Wurm kam über ein gekapertes Software-Update, zerstörte Daten in der Ukraine und 64 weiteren Ländern und kostete Milliarden US-Dollar."},"disclosed":"2017-06-27","en":{"credit":"Analyzed by ESET, Cisco Talos and Microsoft","fixed":"MS17-010 (March 14, 2017) for the SMB flaws; no patch stops the spread with stolen passwords, and the data could not be recovered","product":"Windows networks, reached through the Ukrainian accounting software M.E.Doc","summary":"A worm posing as ransomware came through a hijacked software update, destroyed data in Ukraine and 64 more countries, and cost billions of dollars."},"figures":[{"de":"Millionen US-Dollar Kosten erwartete allein die Reederei Maersk (Pressebericht)","en":"million US dollars in costs expected by the shipping group Maersk alone (press report)","value":"200–300"},{"de":"Unternehmen allein in der Ukraine getroffen, bestätigt von der ukrainischen Cyberpolizei","en":"companies hit in Ukraine alone, as confirmed by Ukraine's Cyber Police","value":"2,000+"},{"de":"weitere Länder neben der Ukraine mit Infektionen in den Daten von Microsoft","en":"countries besides Ukraine with infections in Microsoft's data","value":"64"},{"de":"Lösegeldzahlungen bis zum 3. August 2017, zusammen 9.835,86 US-Dollar wert","en":"ransom payments by August 3, 2017, worth USD 9,835.86","value":"33"}],"kev":"2022-02-10","key":"notpetya","name":"NotPetya","product":"Microsoft Windows (SMBv1), M.E.Doc","sources":[{"de":"Microsoft: Neue Ransomware, alte Techniken – Petya kann sich jetzt als Wurm verbreiten","title":"Microsoft: New ransomware, old techniques: Petya adds worm capabilities","url":"https://www.microsoft.com/en-us/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/"},{"de":"ESET: Analyse der Hintertür in den M.E.Doc-Updates","title":"ESET: analysis of the backdoor in M.E.Doc updates","url":"https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/"},{"de":"Cisco Talos: The MeDoc Connection, die Untersuchung des Update-Servers","title":"Cisco Talos: The MeDoc Connection, forensics of the update server","url":"https://blog.talosintelligence.com/2017/07/the-medoc-connection.html"},{"de":"NVD: CVE-2017-0144","title":"NVD: CVE-2017-0144","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0144"},{"de":"Weißes Haus: Erklärung zu NotPetya (Februar 2018)","title":"White House: statement on NotPetya (February 2018)","url":"https://trumpwhitehouse.archives.gov/briefings-statements/statement-press-secretary-25/"},{"de":"Britisches Außenministerium: Erklärung zu NotPetya (Februar 2018)","title":"UK Foreign Office: statement on NotPetya (February 2018)","url":"https://www.gov.uk/government/news/foreign-office-minister-condemns-russia-for-notpetya-attacks"},{"de":"Bitcoin-Analyse der Lösegeldzahlungen an WannaCry und NotPetya (Computers \u0026 Security, 2018)","title":"Bitcoin analysis of WannaCry and NotPetya ransom payments (Computers \u0026 Security, 2018)","url":"https://arxiv.org/pdf/1804.01341"},{"de":"Reuters über Business Insurance: die erwarteten Kosten von Maersk (Presse)","title":"Reuters via Business Insurance: Maersk's expected cost (press)","url":"https://www.businessinsurance.com/article/20170816/NEWS06/912315214/Maersk-upbeat-on-shipping-outlook-faces-hefty-cyber-attack-bill"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","year":2017}},"description":"A hijacked update of a Ukrainian accounting program released a worm that posed as ransomware, destroyed data and caused billions of dollars in damage.","language":"en","latest_measurement":"2026-11-01","method":"latency-v3","method_page":"https://crackthe.net/data/method/","source":"https://crackthe.net/","text":"On June 27, 2017, a program that looked like ransomware spread through company networks in Ukraine. Microsoft saw infections in 64 more countries. Ransomware locks files and demands money to unlock them. This program destroyed data, and paying did not bring it back. Its main way in was a hijacked update of M.E.Doc, an accounting program widely used in Ukraine. Inside networks, it also used the Windows flaw behind WannaCry.\nHow it worked The attackers took over the update servers of M.E.Doc. From April 2017, they slipped a backdoor into three regular updates of the program: on April 14, May 15, and June 22. A backdoor is a hidden way into a computer. On June 27, five days after the last of these updates, they used this channel to drop NotPetya into thousands of company networks at once. Cisco Talos found the malicious traffic in the logs of the update server from 9:11 a.m. to 12:31 p.m. UTC.\nInside a network, NotPetya spread in two ways. It pulled passwords out of the computer\u0026rsquo;s memory. With them, it used standard Windows administration tools, PsExec and WMIC, to copy itself to every machine it could reach. This worked even on fully updated computers. On machines without Microsoft\u0026rsquo;s update of March 2017, it also used EternalBlue and EternalRomance, two attack tools leaked from the US National Security Agency (NSA). They exploit flaws in SMB version 1, the old Windows file-sharing protocol.\nThen it overwrote the disk\u0026rsquo;s boot record, the part a computer reads first when it starts. It restarted the computer behind a fake disk-check screen and encrypted the index of the file system. This index records where each file is stored. The ransom note asked for 300 US dollars in Bitcoin, but the data could not be restored even after payment. Researchers therefore classed NotPetya as a wiper, a program built to destroy data, dressed up as ransomware.\nM.E.Doc updatecarries NotPetya into company networks Stolen passwordscopy it to every machine it can reach EternalBluetakes over machines without the March update Diskboot record overwritten, data lost Two ways to spread inside a network: the stolen passwords worked even on fully updated computers. A hijacked update is not a flaw in the program\u0026rsquo;s code, and no CVE number was found for it. That is why this page names the Windows flaw CVE-2017-0144, which EternalBlue exploits, as the main CVE. But it was only one of NotPetya\u0026rsquo;s ways to spread. Microsoft links EternalRomance to a second flaw, CVE-2017-0145.\nReach and damage Microsoft\u0026rsquo;s telemetry, the data it receives from its customers\u0026rsquo; computers, counted more than 12,500 machines in Ukraine that encountered NotPetya. It also saw infections in 64 more countries. This is not a full count: Microsoft sees only its own customers. Ukraine\u0026rsquo;s Cyber Police confirmed over 2,000 affected companies in Ukraine alone, Cisco Talos reported. According to Talos, 80 % of Ukrainian businesses use M.E.Doc for their accounting.\nThe US government called NotPetya the most destructive and costly cyberattack in history, with billions of dollars in damage across Europe, Asia, and the Americas. The UK government said it cost organizations across Europe hundreds of millions of pounds. Neither gave an exact total. Higher totals that circulate, such as USD 10 billion, come from press interviews, not from official documents.\nThe shipping group Maersk expected a bill of USD 200 to 300 million, mainly in the third quarter of 2017, Reuters reported.\nThe attackers earned almost nothing. Their single Bitcoin address received 33 ransom payments by August 3, 2017, worth USD 9,835.86. That fits a wiper rather than ransomware.\nRansom payments received, in the same study NotPetya, June 27 to August 3, 201733 WannaCry, May 12 to October 2, 2017238 Source: Bitcoin payment analysis, Computers \u0026amp; Security, 2018. The two periods differ in length.\nThe fix and the response Microsoft had fixed the SMB flaws on March 14, 2017, with security update MS17-010. That update stopped EternalBlue and EternalRomance, but not the spread with stolen passwords. Companies had to remove the backdoored M.E.Doc versions. Because the encrypted data could not be decrypted, affected systems had to be rebuilt.\nOn the day of the outbreak, Microsoft described how the worm spread. ESET found the backdoor in the M.E.Doc updates, and Cisco Talos examined the update server. Both published their analyses in early July 2017. On February 15, 2018, the UK government and the White House named the Russian military as responsible for the attack.","title":"NotPetya: the destructive worm hidden in a software update","url":"https://crackthe.net/security/vulnerabilities/notpetya/"}