Ask whether you could have limited NotPetya by answering ten questions about updates, credentials, SMB exposure, network segments and backups. CISA's report says it spread through a tax software update, stolen Windows credentials and unpatched SMB flaws. These are control checks, not a judgment of any victim.
What happened?
On 27 June 2017, CISA's predecessor team was notified of Petya malware infections in multiple countries and sectors. CISA's alert describes the NotPetya variant as encrypting files with extensions from a hard coded list and, with administrator rights, the master boot record, leaving Windows machines unusable. CISA says it behaves more like destructive malware than ransomware, because the encryption key has no verifiable link to the victim ID. In February 2018 the US government publicly attributed it to the Russian military.
Victims included organizations in finance, transportation, energy, commercial facilities and healthcare. Many were not the intended target. They were reached through shared software and flat networks.
How did it spread?
Per CISA, delivery came through the Ukrainian tax accounting software M.E.Doc, whose development environment had a backdoor as early as 14 April 2017. Inside networks, the most effective method used a modified Mimikatz to steal Windows credentials, followed by WMIC or PsExec to reach other systems. It also used the EternalBlue and EternalRomance SMBv1 exploits against unpatched systems; Microsoft's MS17-010 patch had been released on 14 March 2017.
So three doors: a trusted software update, stolen credentials and unpatched file sharing.
The checklist
- Trusted updates. Do you know which third party software auto updates inside your network, and could you hold an update while you check it? CISA advises treating systems with the affected software as suspicious.
- Inventory. Within an hour, can you list every host running a named product?
- Patch coverage. Was a critical SMB patch, released months earlier, installed everywhere? What is your actual coverage and the oldest exception?
- SMBv1. Is it disabled, and is SMB blocked at network boundaries? CISA notes this may disrupt shared resources, so test first.
- Credential hygiene. Do administrators log in to ordinary workstations, leaving reusable credentials in memory? Least privilege for admin rights limits what stolen credentials can do.
- Lateral movement. Is remote execution through PsExec blocked, remote WMI restricted and workstation to workstation traffic denied by host firewalls?
- Segmentation. If one site is infected, can it reach the others? CISA recommends network segregation and out of band management.
- Backups. Are backups regularly tested and kept where malware on the network cannot reach them?
- Detection. Would you see a burst of remote service creation or credential dumping tools, and who would be paged?
- Response plan. Do you have an incident and continuity plan, and a named contact to the FBI field office and reporting channels? CISA advises preserving logs and not paying, since payment does not guarantee recovery.
What is the supply chain lesson?
The first step was code from a vendor that customers trusted. Software supply chain security means knowing what you run, how it updates and what that update can reach. A component inventory such as an SBOM tells you where a product lives; segmentation and credential controls limit what a bad update can do once there.
Safeguard can help build that inventory of what you ship and depend on, but the network and credential items above belong to your infrastructure program.
What to do
- Score the ten questions as yes, partly or no, with an owner for each partial or no.
- Run a one hour drill: name a product and list every host that runs it.
- Fix the cheapest gaps first: disable SMBv1, restrict admin logins, test restores.
- Put vendor update channels on your risk register.
- Revisit the checklist after each major architecture change.
Quick check
Was NotPetya ransomware?
CISA says it behaves more like destructive malware than ransomware, since paying may not recover files.
Is patching alone enough?
No. The same event used stolen credentials and a trusted update, so segmentation and privilege limits matter too.
Sources
Last reviewed: 18 October 2026.
