{"data":{"case":{"actions":{"de":["Installiere **MS17-010** oder ein späteres Windows-Update auf jedem Computer und schalte **SMB Version 1** ab.","Verwende nicht dasselbe Administratorpasswort auf vielen Computern: NotPetya verbreitete sich mit gestohlenen Passwörtern, und das verhindert kein Patch.","Falls noch eine alte M.E.Doc-Installation vorhanden ist, entferne die Versionen 10.01.175–10.01.176, 10.01.180–10.01.181 und 10.01.188–10.01.189: Diese Versionen enthielten die Hintertür."],"en":["Install **MS17-010** or any later Windows update on every computer, and switch off **SMB version 1**.","Do not use the same administrator password on many computers: NotPetya spread with stolen passwords, which no patch prevents.","If an old M.E.Doc installation is still around, remove versions 10.01.175–10.01.176, 10.01.180–10.01.181 and 10.01.188–10.01.189: they carried the backdoor."]},"criteria":{"damage":{"de":"Die US-Regierung beziffert den Schaden in Europa, Asien und Amerika auf Milliarden US-Dollar; allein Maersk rechnete mit 200–300 Millionen US-Dollar (Weißes Haus; Reuters, Pressebericht).","en":"The US government puts the damage at billions of dollars across Europe, Asia and the Americas; Maersk alone expected USD 200–300 million (White House; Reuters, press report).","met":true},"exploitation":{"de":"NotPetya verbreitete sich selbstständig durch Netzwerke und traf allein in der Ukraine über 2.000 Unternehmen (ukrainische Cyberpolizei über Cisco Talos).","en":"NotPetya spread through networks on its own and hit over 2,000 companies in Ukraine alone (Ukraine's Cyber Police via Cisco Talos).","met":true},"reach":{"de":"Die gemessenen Zahlen bleiben unter der Schwelle: mehr als 12.500 Rechner in der Ukraine und Infektionen in 64 weiteren Ländern in den Daten von Microsoft sowie über 2.000 Unternehmen in der Ukraine (Microsoft; ukrainische Cyberpolizei über Cisco Talos).","en":"Measured counts stay below the threshold: more than 12,500 machines in Ukraine and infections in 64 more countries in Microsoft's data, and over 2,000 companies in Ukraine (Microsoft; Ukraine's Cyber Police via Cisco Talos).","met":false},"response":{"de":"Die Regierungen Großbritanniens und der USA machten das russische Militär verantwortlich, doch einen Angreifer zu benennen schützt niemanden, und keine Maßnahme über den vorhandenen Patch hinaus ist belegt (britisches Außenministerium; Weißes Haus).","en":"The UK and US governments named the Russian military as responsible, but naming an attacker does not protect anyone, and no measure beyond the existing patch is documented (UK Foreign Office; White House).","met":false}},"cves":["CVE-2017-0144","CVE-2017-0145"],"cvss":8.8,"cvss_version":"3.1","dates":[{"date":"2017-03-14","key":"patched"},{"date":"2017-04-14","de":"Erstes M.E.Doc-Update mit einer versteckten Hintertür","en":"First M.E.Doc update with a hidden backdoor"},{"date":"2017-06-22","de":"Drittes und letztes M.E.Doc-Update mit der Hintertür","en":"Third and last M.E.Doc update with the backdoor"},{"date":"2017-06-27","key":"outbreak"},{"date":"2018-02-15","de":"Die Regierungen Großbritanniens und der USA machen das russische Militär verantwortlich","en":"The UK and US governments name the Russian military as responsible"}],"de":{"credit":"Analysiert von ESET, Cisco Talos und Microsoft","fixed":"MS17-010 (14. März 2017) für die SMB-Lücken; kein Patch verhindert die Ausbreitung mit gestohlenen Passwörtern, und die Daten ließen sich nicht wiederherstellen","product":"Windows-Netzwerke, erreicht über die ukrainische Buchhaltungssoftware M.E.Doc","summary":"Ein als Ransomware getarnter Wurm kam über ein gekapertes Software-Update, zerstörte Daten in der Ukraine und 64 weiteren Ländern und kostete Milliarden US-Dollar."},"disclosed":"2017-06-27","en":{"credit":"Analyzed by ESET, Cisco Talos and Microsoft","fixed":"MS17-010 (March 14, 2017) for the SMB flaws; no patch stops the spread with stolen passwords, and the data could not be recovered","product":"Windows networks, reached through the Ukrainian accounting software M.E.Doc","summary":"A worm posing as ransomware came through a hijacked software update, destroyed data in Ukraine and 64 more countries, and cost billions of dollars."},"figures":[{"de":"Millionen US-Dollar Kosten erwartete allein die Reederei Maersk (Pressebericht)","en":"million US dollars in costs expected by the shipping group Maersk alone (press report)","value":"200–300"},{"de":"Unternehmen allein in der Ukraine getroffen, bestätigt von der ukrainischen Cyberpolizei","en":"companies hit in Ukraine alone, as confirmed by Ukraine's Cyber Police","value":"2,000+"},{"de":"weitere Länder neben der Ukraine mit Infektionen in den Daten von Microsoft","en":"countries besides Ukraine with infections in Microsoft's data","value":"64"},{"de":"Lösegeldzahlungen bis zum 3. August 2017, zusammen 9.835,86 US-Dollar wert","en":"ransom payments by August 3, 2017, worth USD 9,835.86","value":"33"}],"kev":"2022-02-10","key":"notpetya","name":"NotPetya","product":"Microsoft Windows (SMBv1), M.E.Doc","sources":[{"de":"Microsoft: Neue Ransomware, alte Techniken – Petya kann sich jetzt als Wurm verbreiten","title":"Microsoft: New ransomware, old techniques: Petya adds worm capabilities","url":"https://www.microsoft.com/en-us/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/"},{"de":"ESET: Analyse der Hintertür in den M.E.Doc-Updates","title":"ESET: analysis of the backdoor in M.E.Doc updates","url":"https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/"},{"de":"Cisco Talos: The MeDoc Connection, die Untersuchung des Update-Servers","title":"Cisco Talos: The MeDoc Connection, forensics of the update server","url":"https://blog.talosintelligence.com/2017/07/the-medoc-connection.html"},{"de":"NVD: CVE-2017-0144","title":"NVD: CVE-2017-0144","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0144"},{"de":"Weißes Haus: Erklärung zu NotPetya (Februar 2018)","title":"White House: statement on NotPetya (February 2018)","url":"https://trumpwhitehouse.archives.gov/briefings-statements/statement-press-secretary-25/"},{"de":"Britisches Außenministerium: Erklärung zu NotPetya (Februar 2018)","title":"UK Foreign Office: statement on NotPetya (February 2018)","url":"https://www.gov.uk/government/news/foreign-office-minister-condemns-russia-for-notpetya-attacks"},{"de":"Bitcoin-Analyse der Lösegeldzahlungen an WannaCry und NotPetya (Computers \u0026 Security, 2018)","title":"Bitcoin analysis of WannaCry and NotPetya ransom payments (Computers \u0026 Security, 2018)","url":"https://arxiv.org/pdf/1804.01341"},{"de":"Reuters über Business Insurance: die erwarteten Kosten von Maersk (Presse)","title":"Reuters via Business Insurance: Maersk's expected cost (press)","url":"https://www.businessinsurance.com/article/20170816/NEWS06/912315214/Maersk-upbeat-on-shipping-outlook-faces-hefty-cyber-attack-bill"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","year":2017}},"description":"A hijacked update of a Ukrainian accounting program released a worm that posed as ransomware, destroyed data and caused billions of dollars in damage.","language":"en","latest_measurement":"2026-10-23","method":"latency-v3","method_page":"https://crackthe.net/method/","source":"https://crackthe.net/","text":"On June 27, 2017, a program that looked like ransomware spread through company networks in Ukraine, and Microsoft saw infections in 64 more countries. Ransomware locks files and demands money to unlock them; this program destroyed data, and paying did not bring it back. Its main way in was a hijacked update of M.E.Doc, an accounting program widely used in Ukraine, and inside networks it also used the Windows flaw behind WannaCry.\nHow it worked The attackers took over the update servers of M.E.Doc. From April 2017, they slipped a backdoor, a hidden way into a computer, into three regular updates of the program: on April 14, May 15, and June 22. On June 27, five days after the last of them, they used this channel to drop NotPetya into thousands of company networks at once. Cisco Talos found the malicious traffic in the logs of the update server from 9:11 a.m. to 12:31 p.m. UTC.\nInside a network, NotPetya spread in two ways. It pulled passwords out of the computer\u0026rsquo;s memory and used them with standard Windows administration tools, PsExec and WMIC, to copy itself to every machine it could reach. This worked even on fully updated computers. On machines without Microsoft\u0026rsquo;s update of March 2017, it also used EternalBlue and EternalRomance, two attack tools leaked from the US National Security Agency (NSA). They exploit flaws in SMB version 1, the old Windows file-sharing protocol.\nThen it overwrote the disk\u0026rsquo;s boot record, the part a computer reads first when it starts. It restarted the computer behind a fake disk-check screen and encrypted the index of the file system, the table that records where each file is stored. The ransom note asked for 300 US dollars in Bitcoin, but the data could not be restored even after payment. Researchers therefore classed NotPetya as a wiper, a program built to destroy data, dressed up as ransomware.\nM.E.Doc updatecarries NotPetya into company networks Stolen passwordscopy it to every machine it can reach EternalBluetakes over machines without the March update Diskboot record overwritten, data lost Two ways to spread inside a network: the stolen passwords worked even on fully updated computers. A hijacked update is not a flaw in the program\u0026rsquo;s code, and no CVE number was found for it. That is why this page names the Windows flaw CVE-2017-0144, which EternalBlue exploits, as the main CVE, although it was only one of NotPetya\u0026rsquo;s ways to spread. Microsoft links EternalRomance to a second flaw, CVE-2017-0145.\nReach and damage Microsoft\u0026rsquo;s telemetry, the data it receives from its customers\u0026rsquo; computers, counted more than 12,500 machines in Ukraine that encountered NotPetya, and infections in 64 more countries. This is not a full count: Microsoft sees only its own customers. Ukraine\u0026rsquo;s Cyber Police confirmed over 2,000 affected companies in Ukraine alone, Cisco Talos reported. According to Talos, 80 % of Ukrainian businesses use M.E.Doc for their accounting.\nThe US government called NotPetya the most destructive and costly cyberattack in history, with billions of dollars in damage across Europe, Asia, and the Americas. The UK government said it cost organizations across Europe hundreds of millions of pounds. Neither gave an exact total. Higher totals that circulate, such as USD 10 billion, come from press interviews, not from official documents.\nOne company figure comes from the press: the shipping group Maersk expected a bill of USD 200 to 300 million, mainly in the third quarter of 2017, Reuters reported.\nThe attackers earned almost nothing. Their single Bitcoin address received 33 ransom payments by August 3, 2017, worth USD 9,835.86. That is tiny compared with the damage, and it fits a wiper rather than ransomware.\nRansom payments received, in the same study NotPetya, June 27 to August 3, 201733 WannaCry, May 12 to October 2, 2017238 Source: Bitcoin payment analysis, Computers \u0026amp; Security, 2018. The two periods differ in length.\nThe fix and the response Microsoft had fixed the SMB flaws on March 14, 2017, with security update MS17-010. That update stopped EternalBlue and EternalRomance, but not the spread with stolen passwords. Companies had to remove the backdoored M.E.Doc versions. Because the encrypted data could not be decrypted, affected systems had to be rebuilt.\nOn the day of the outbreak, Microsoft described how the worm spread. ESET found the backdoor in the M.E.Doc updates, and Cisco Talos examined the update server; both published their analyses in early July 2017. On February 15, 2018, the UK government and the White House named the Russian military as responsible for the attack.","title":"NotPetya: the destructive worm hidden in a software update","url":"https://crackthe.net/vulnerabilities/notpetya/"}