NotPetya: the US$10 billion cyberattack, 9 years on

On the morning of 27 June 2017, employees at companies across Ukraine opened their computers and saw a black screen with red lettering demanding US$300 in Bitcoin to recover their files. It looked like just another piece of ransomware of the kind that had been circulating for years. It wasn't. Hours later, the same code had taken down Maersk port terminals on four continents, halted production lines at Merck and Saint-Gobain, and frozen FedEx delivery systems. Nine years on, NotPetya is still cited as the costliest cyberattack in history — something close to US$10 billion in damage, according to a White House assessment.

The reason this case is still worth revisiting isn't nostalgia. It's that NotPetya combined three elements that keep showing up in major incidents to this day: a supply chain compromise, exploitation of an already-known flaw, and lateral propagation via credential theft. Understanding how each piece worked helps explain why similar attacks keep happening.

How it all started: an accounting software update

The entry point wasn't a phishing email or a port exposed to the internet. It was a legitimate update to M.E.Doc, an accounting and invoicing package extremely popular in Ukraine — practically every company that paid tax in the country used the program. Security researchers traced the origin of the attack back to the update servers of Intellect Service, M.E.Doc's developer, which had been compromised in advance.

Anyone installing the normal software update was, without knowing it, installing NotPetya. There was nothing visibly wrong: the digital signature checked out, the installer ran normally. That's exactly the same pattern that reappears in more recent supply chain compromises, such as the MOVEit case, where trust in a legitimate tool is what becomes the way in.

EternalBlue and Mimikatz: the combination that multiplied the damage

Once inside the network, NotPetya no longer depended on M.E.Doc. It used two techniques together to spread laterally between Windows machines on the same network, even without internet access:

• EternalBlue: the same exploit leaked from the NSA's arsenal by the Shadow Brokers group, used weeks earlier in WannaCry, which abused a flaw in the SMBv1 protocol to execute code remotely on machines without the corresponding patch.
• Mimikatz: a tool originally created in 2011 to demonstrate how Windows kept credentials in memory. NotPetya used Mimikatz to extract passwords and authentication tokens straight from RAM and use them to move between machines — including ones that already had the EternalBlue patch installed.

That second vector is the most underestimated detail of the case: fixing a single vulnerability wasn't enough. If the malware got hold of valid administrative credentials anywhere on the network, it spread as though it were logging in normally — with no need for any exploit from that point on.

Was NotPetya really ransomware?

No. Researchers at Kaspersky and Comae Technologies discovered, in the first days of the attack, that NotPetya had no way to reverse the encryption it applied. The ransom screen, the Bitcoin address, the countdown — it was all theatre. The malware overwrote the disk's master file table (MFT) in a way that made recovery impossible even if the victim paid. That's why the security community quickly started calling it a wiper disguised as ransomware: the goal wasn't extortion, it was destruction.

The bill: Maersk, Merck, FedEx and the factory that stopped

The loss figures, disclosed by the companies themselves in financial reports, give a sense of the reach:

• Merck: more than US$870 million, with vaccine production lines shut down.
• Maersk: around US$300 million — the world's largest shipping company lost practically its entire IT infrastructure, including cargo scheduling systems at 76 ports.
• FedEx (via its TNT Express subsidiary): around US$400 million.
• Saint-Gobain: around US$384 million.

The Maersk case became famous for an almost cinematic detail. The company lost practically all of its Active Directory domain controllers — except one, at a branch in Ghana, which survived because a power cut had left the machine disconnected from the network at the exact moment of infection. That "accidental air gap" preserved the only intact copy of the company's domain structure, and an employee had to fly with the disk to the United Kingdom because the local internet link was too slow to transfer the data. Even with that stroke of luck, Maersk took around ten days to reinstall 4,000 servers and 45,000 computers, and months to fully normalise operations.

Attribution: Russia, the GRU and the legal precedent that still echoes

In February 2018, the UK government formally attributed NotPetya to the GRU, Russian military intelligence — specifically to the unit known as Sandworm. The White House and other Five Eyes governments followed with similar statements the same week, classifying the attack as part of a destabilisation campaign against Ukraine that escaped control and spread to 65 countries.

The case also produced a rare precedent outside the technical field: Merck sued its insurers after they denied cover for the loss by invoking an "act of war" exclusion clause, arguing that an attack attributed to a government qualified as an act of warfare. In December 2021, a New Jersey court ruled in Merck's favour, holding that the clause did not apply to this kind of cyberattack. The case was settled in January 2024, with a US$1.4 billion payment by the insurers — a figure that has reshaped how the cyber insurance market writes that kind of exclusion to this day.

What's still worth taking into practice

NotPetya invented no new technique — it combined three old and well-documented problems in a way that multiplied the damage. The practical lessons remain the same almost a decade later:

• Patching critical vulnerabilities isn't optional, especially when the exploit is already public. EternalBlue had a fix available months before NotPetya — and before WannaCry, which had already warned the world about the risk.
• Network segmentation limits the damage. If a compromised machine can't reach administrative credentials for the whole company, credential theft via tools like Mimikatz loses much of its force.
• Backups isolated from the network save companies. Maersk only avoided losing its entire Active Directory by chance. Companies that treat this as strategy — not as luck — come out ahead in any ransomware or wiper incident.
• Third-party software is part of your attack surface. Assessing supplier security has stopped being compliance paperwork and become direct prevention, as the more recent case of the Miasma worm in Red Hat's npm packages shows.

The Morris Worm, almost 30 years earlier, had already shown that an incident big enough forces the creation of infrastructure that should have existed beforehand. NotPetya repeated the pattern at global corporate scale: companies that treated network segmentation and patch management as a recommendation started treating them as a requirement. If you administer Windows environments today, it's worth reviewing the list of settings in our guide to hardening Windows 11 — a good part of it exists precisely because of incidents like this one.