NotPetya was destructive malware delivered through a compromised update of a Ukrainian accounting package on 27 June 2017. It spread across corporate networks with stolen credentials and old Windows exploits, and shipping line Maersk was among those hit hard. The lessons are about identity, network segmentation and tested recovery.
Facts about the malware and attribution come from CISA and the White House. Facts about Maersk come from an incident database entry that cites press reporting we could not retrieve directly, so treat Maersk specifics as needing confirmation from primary reporting.
What is the timeline?
- 14 March 2017. Microsoft released a security update, MS17-010, covering the SMB vulnerabilities that two of NotPetya's spreading methods used.
- 14 April 2017. CISA's alert says the actors used a backdoor to compromise the development environment of M.E.Doc, Ukrainian tax accounting software, as far back as this date.
- 27 June 2017. CISA's alert says the delivery mechanism during the event was M.E.Doc. NCCIC was notified of Petya-like malware events in multiple countries and sectors that day.
- 15 February 2018. The White House press secretary stated that the Russian military launched the attack, called NotPetya, and that it caused billions of dollars in damage across Europe, Asia and the Americas.
An incident database entry describes Maersk's loss of most of its global IT estate within hours, including domain controllers and backups, direct losses of roughly $300 million as reported by the company, and a rebuild that took ten days using a single surviving domain controller in Ghana. Those details come through a secondary source citing Wired.
How did the malware spread?
CISA's analysis lists four lateral movement techniques: PsExec, WMI, EternalBlue and EternalRomance. The first and in most cases most effective method used a modified credential theft tool, then WMIC or psexec with the stolen credentials to reach other machines. Another used the SMBv1 exploit against unpatched systems.
CISA also observed that the malware behaved more like destructive malware than ransomware. There was no evidence of a relationship between the encryption key and the victim identifier, so decryption might not be possible even if the ransom was paid.
What should defenders learn?
One: your update channel is an attack path. The compromise rode a legitimate product's update. Inventory the software that updates itself on your network, especially from smaller regional vendors, and restrict where it may connect.
Two: credentials move faster than patches. The most effective spreading method relied on stolen credentials. Limit local administrator reuse, restrict remote execution tools and tier your admin accounts so a workstation compromise does not reach domain controllers.
Three: segment. A flat network let one infection reach everything. Separate business units, regions and critical services.
Four: protect identity infrastructure and its backups. If every domain controller can be wiped at once, recovery stalls. Keep offline, tested copies and a documented rebuild order. The reported Ghana survivor is a reminder that luck is not a plan.
Five: practice rebuilding, not just restoring. Time how long it would take to reinstall your most critical systems from nothing. Include dependencies such as DNS, directory services and licensing.
Six: patch the old protocol exposures. CISA notes the update for the SMB flaws existed months earlier. Disable SMBv1 where you can.
What to do
- Inventory auto updating third party software and its update sources.
- Remove local admin reuse and deploy unique local admin passwords.
- Tier administrative accounts and block admin logons to lower tier machines.
- Segment the network by function and region, and limit SMB between segments.
- Keep offline, tested backups of directory services and document the rebuild order.
- Disable SMBv1 and verify the MS17-010 update status on legacy hosts.
- Run a timed rebuild exercise annually and record the gaps.
- Pre-agree who can isolate a region or business unit during an outbreak.
Quick check
Was NotPetya ordinary ransomware?
CISA's analysis says it behaved more like destructive malware, since decryption might not be possible even with payment.
How did it get into networks?
CISA says the delivery mechanism on 27 June 2017 was the Ukrainian tax accounting software M.E.Doc, whose development environment had been compromised.
Sources
- CISA, Petya Ransomware alert (NotPetya analysis), fetched 18 October 2026
- White House, Statement from the Press Secretary, 15 February 2018, fetched 18 October 2026
- Maersk NotPetya attack, risidata database entry, fetched 18 October 2026 (secondary source)
Last reviewed: 18 October 2026.
