NotPetya

Description

NotPetya is a 20217 wiper disguised as ransomware that initially targeted Ukrainian infrastructure, but quickly spread globally. It is attributed to Sandworm, a Russian millitary intelligence unit, and was responsible fro the cosliest cyberattack ever.

Stats

First seen: January 2023
Last seen: October 2026

Also known as

ExPetrGoldenEyeGoldeneyePetrWrap

MITRE ATT&CK techniques

14 techniques across 7 tactics.

TA0002 Execution

T1047Windows Management Instrumentation
T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1569System Services
- T1569.002Service Execution

TA0005 Stealth

T1036Masquerading
T1078Valid Accounts
- T1078.003Local Accounts
T1218System Binary Proxy Execution
- T1218.011Rundll32

TA0006 Credential Access

T1003OS Credential Dumping
- T1003.001LSASS Memory

TA0007 Discovery

T1083File and Directory Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0008 Lateral Movement

T1021Remote Services
- T1021.002SMB/Windows Admin Shares
T1210Exploitation of Remote Services

TA0040 Impact

T1486Data Encrypted for Impact
T1529System Shutdown/Reboot

TA0112 Defense Impairment

T1685Disable or Modify Tools
- T1685.005Clear Windows Event Logs

Associated groups

G0034Sandworm Team

Alert name variants

Alert Name	Engine
Boot.Ransomware.GoldenEye	ATP Sandbox Adv. Heuristics
Document-Excel.Ransomware.GoldenEye	ATP Sandbox Adv. Heuristics
Document-Excel.Trojan.Goldeneye	ATP Sandbox Adv. Heuristics
Dropped:Trojan.Ransom.GoldenEye.B	AV
Dump:Generic.Ransom.GoldenEye.6A1DA6F2	AV
Gen:Variant.Ransom.ExPetr.2	AV
Generic.Ransom.GoldenEye.2487E67A	AV
Generic.Ransom.GoldenEye.494A7C33	AV
Generic.Ransom.GoldenEye.558FCDEC	AV
Generic.Ransom.GoldenEye.7D78CD7F	AV
Generic.Ransom.GoldenEye.DD84EA30	AV
Trojan.Ransom.EFI.GoldenEye.1	AV
Trojan.Ransom.GoldenEye.B	AV
Trojan.Ransom.GoldenEye.D	AV
Win32.Ransomware.GoldenEye	ATP Sandbox Adv. Heuristics
Win32.Ransomware.PetrWrap	ATP Sandbox Adv. Heuristics
Win64.Ransomware.GoldenEye	ATP Sandbox Adv. Heuristics
Win64.Ransomware.NotPetya	ATP Sandbox Adv. Heuristics

Related blogs

Lessons Learned From a Year of Russo-Ukrainian Cyberwar

February 24, 20233 min read

Stepping Stone Attack launches EternalBlue Internally

November 2, 20175 min read