NotPetya: the destructive worm hidden in a software update

On June 27, 2017, a program that looked like ransomware spread through company networks in Ukraine, and Microsoft saw infections in 64 more countries. Ransomware locks files and demands money to unlock them; this program destroyed data, and paying did not bring it back. Its main way in was a hijacked update of M.E.Doc, an accounting program widely used in Ukraine, and inside networks it also used the Windows flaw behind WannaCry.

How it worked

The attackers took over the update servers of M.E.Doc. From April 2017, they slipped a backdoor, a hidden way into a computer, into three regular updates of the program: on April 14, May 15, and June 22. On June 27, five days after the last of them, they used this channel to drop NotPetya into thousands of company networks at once. Cisco Talos found the malicious traffic in the logs of the update server from 9:11 a.m. to 12:31 p.m. UTC.

Inside a network, NotPetya spread in two ways. It pulled passwords out of the computer’s memory and used them with standard Windows administration tools, PsExec and WMIC, to copy itself to every machine it could reach. This worked even on fully updated computers. On machines without Microsoft’s update of March 2017, it also used EternalBlue and EternalRomance, two attack tools leaked from the US National Security Agency (NSA). They exploit flaws in SMB version 1, the old Windows file-sharing protocol.

Then it overwrote the disk’s boot record, the part a computer reads first when it starts. It restarted the computer behind a fake disk-check screen and encrypted the index of the file system, the table that records where each file is stored. The ransom note asked for 300 US dollars in Bitcoin, but the data could not be restored even after payment. Researchers therefore classed NotPetya as a wiper, a program built to destroy data, dressed up as ransomware.

A hijacked update is not a flaw in the program’s code, and no CVE number was found for it. That is why this page names the Windows flaw CVE-2017-0144, which EternalBlue exploits, as the main CVE, although it was only one of NotPetya’s ways to spread. Microsoft links EternalRomance to a second flaw, CVE-2017-0145.

Reach and damage

Microsoft’s telemetry, the data it receives from its customers’ computers, counted more than 12,500 machines in Ukraine that encountered NotPetya, and infections in 64 more countries. This is not a full count: Microsoft sees only its own customers. Ukraine’s Cyber Police confirmed over 2,000 affected companies in Ukraine alone, Cisco Talos reported. According to Talos, 80 % of Ukrainian businesses use M.E.Doc for their accounting.

The US government called NotPetya the most destructive and costly cyberattack in history, with billions of dollars in damage across Europe, Asia, and the Americas. The UK government said it cost organizations across Europe hundreds of millions of pounds. Neither gave an exact total. Higher totals that circulate, such as USD 10 billion, come from press interviews, not from official documents.

One company figure comes from the press: the shipping group Maersk expected a bill of USD 200 to 300 million, mainly in the third quarter of 2017, Reuters reported.

The attackers earned almost nothing. Their single Bitcoin address received 33 ransom payments by August 3, 2017, worth USD 9,835.86. That is tiny compared with the damage, and it fits a wiper rather than ransomware.

The fix and the response

Microsoft had fixed the SMB flaws on March 14, 2017, with security update MS17-010. That update stopped EternalBlue and EternalRomance, but not the spread with stolen passwords. Companies had to remove the backdoored M.E.Doc versions. Because the encrypted data could not be decrypted, affected systems had to be rebuilt.

On the day of the outbreak, Microsoft described how the worm spread. ESET found the backdoor in the M.E.Doc updates, and Cisco Talos examined the update server; both published their analyses in early July 2017. On February 15, 2018, the UK government and the White House named the Russian military as responsible for the attack.