Your browser does not fully support modern features. Please upgrade for a smoother experience.
Submitted Successfully!
Thank you for your contribution! You can also upload a video entry or images related to this topic. For video creation, please contact our Academic Video Service.
Version Summary Created by Modification Content Size Created at Operation
1 handwiki Camila Xu -- 1825 2022-10-19 01:49:54

Video Upload Options

We provide professional Academic Video Service to translate complex research into visually appealing presentations. Would you like to try it?
No, upload directly Yes
Cite
If you have any further questions, please contact Encyclopedia Editorial Office.
HandWiki. Petya and NotPetya. Encyclopedia. Available online: https://encyclopedia.pub/entry/30016 (accessed on 22 September 2026).
HandWiki. Petya and NotPetya. Encyclopedia. Available at: https://encyclopedia.pub/entry/30016. Accessed September 22, 2026.
HandWiki. "Petya and NotPetya" Encyclopedia, https://encyclopedia.pub/entry/30016 (accessed September 22, 2026).
HandWiki. (2022, October 19). Petya and NotPetya. In Encyclopedia. https://encyclopedia.pub/entry/30016
HandWiki. "Petya and NotPetya." Encyclopedia. Web. 19 October, 2022.
Petya and NotPetya
Edit
The content is sourced from: https://handwiki.org/wiki/Engineering:Petya_and_NotPetya

Petya is a family of encrypting malware that was first discovered in 2016. The malware targets Microsoft Windows–based systems, infecting the master boot record to execute a payload that encrypts a hard drive's file system table and prevents Windows from booting. It subsequently demands that the user make a payment in Bitcoin in order to regain access to the system. Variants of Petya were first seen in March 2016, which propagated via infected e-mail attachments. In June 2017, a new variant of Petya was used for a global cyberattack, primarily targeting Ukraine . The new variant propagates via the EternalBlue exploit, which is generally believed to have been developed by the United States . National Security Agency (NSA), and was used earlier in the year by the WannaCry ransomware. Kaspersky Lab referred to this new version as NotPetya to distinguish it from the 2016 variants, due to these differences in operation. In addition, although it purports to be ransomware, this variant was modified so that it is unable to actually revert its own changes. The NotPetya attacks have been blamed on the Russian government, specifically the Sandworm hacking group within the GRU Russian military intelligence organization, by security researchers, Google, and several governments.

military intelligence eternalblue malware

References

  1. Constantin, Lucian. "Petya ransomware is now double the trouble". NetworkWorld. http://www.networkworld.com/article/3069990/petya-ransomware-is-now-double-the-trouble.html. 
  2. "Decrypting the Petya Ransomware". 11 April 2016. http://blog.checkpoint.com/2016/04/11/decrypting-the-petya-ransomware/. 
  3. Scherschel, Fabian A. (15 December 2016). "Petya, Mischa, Goldeneye: Die Erpresser sind Nerds". Heise Online. https://www.heise.de/newsticker/meldung/Petya-Mischa-Goldeneye-Die-Erpresser-sind-Nerds-3571937.html. "Die Virenschreiber hinter diesen Erpressungstrojanern scheinen große Fans des Films zu sein. Wahrscheinlich sind sie in den Neunzigern aufgewachsen und identifizieren sich mit Boris Grishenko, dem russischen Hacker-Genie aus dem Film. Ob ein Twitter-Konto, welches genau auf dieses Profil passt, ein Bild von Boris Grishenko als Avatar nutzt und nach dem Verbrechersyndikat aus dem Film benannt ist, von den Drahtziehern betrieben wird, konnten wir nicht bestätigen. Aber es ist immerhin denkbar." 
  4. Valery Iliyeva (7 August 2017). "На Дніпропетровщині викрили чоловіка, який розповсюджував вірус "Petya.A"". Dniprograd. http://dniprograd.org/2017/08/07/na-dnipropetrovshchini-vikrili-cholovika-yakiy-rozpovsyudzhuvav-virus-petyaa_59243. 
  5. Ivan Muracha (3 September 2018). "Регіональний "координатор" вірусу РЕТYА на Дніпропетровщині отримав один рік тюрми". Dniprograd. http://dniprograd.org/2018/09/03/regionalniy-koordinator-virusu-retya-na-dnipropetrovshchini-otrimav-odin-rik-tyurmi_70920. 
  6. "Оголошено вирок у справі за фактами масштабних кібератак вірусу "PETYA"". Judiciary of Ukraine. 31 August 2018. https://court.gov.ua/archive/546734/. 
  7. "Global ransomware attack causes chaos". BBC News. 27 June 2017. https://www.bbc.com/news/technology-40416611. 
  8. Turner, Giles; Verbyany, Volodymyr; Kravchenko, Stepan (27 June 2017). "New Cyberattack Goes Global, Hits WPP, Rosneft, Maersk". https://www.bloomberg.com/news/articles/2017-06-27/ukraine-russia-report-ransomware-computer-virus-attacks. 
  9. "Tax software blamed for cyber-attack spread". BBC News. 28 June 2017. https://www.bbc.com/news/technology-40428967. 
  10. "Cyberattack Hits Ukraine Then Spreads Internationally". The New York Times. 27 June 2017. https://mobile.nytimes.com/2017/06/27/technology/ransomware-hackers.html. 
  11. Lee, David (28 June 2017). "'Vaccine' created for huge cyber-attack". BBC News. https://www.bbc.com/news/technology-40427907. 
  12. Burgess, Matt. "There's another 'worldwide' ransomware attack and it's spreading quickly". Wired UK. https://www.wired.co.uk/article/petya-malware-ransomware-attack-outbreak-june-2017. Retrieved 27 June 2017. 
  13. "Microsoft, Analysts See Hack Origin at Ukrainian Software Firm". Bloomberg. 28 June 2017. https://www.bloomberg.com/news/articles/2017-06-28/microsoft-analysts-see-hack-origin-at-ukrainian-software-firm. 
  14. Jack Stubbs, Pavel Polityuk (3 July 2017). "Family firm in Ukraine says it was not responsible for cyber attack". Reuters. https://www.reuters.com/article/us-cyber-attack-ukraine-software-idUSKBN19O2DK. 
  15. Hern, Alex (5 July 2017). "Hackers who targeted Ukraine clean out bitcoin ransom wallet" (in en-GB). The Guardian. ISSN 0261-3077. https://www.theguardian.com/technology/2017/jul/05/notpetya-ransomware-hackers-ukraine-bitcoin-ransom-wallet-motives. 
  16. "A new ransomware outbreak similar to WCry is shutting down computers worldwide". Ars Technica. https://arstechnica.com/security/2017/06/a-new-ransomware-outbreak-similar-to-wcry-is-shutting-down-computers-worldwide/. 
  17. Frenkel, Sheera (27 June 2017). "Global Ransomware Attack: What We Know and Don't Know". The New York Times. https://www.nytimes.com/2017/06/27/technology/global-ransomware-hack-what-we-know-and-dont-know.html. 
  18. "Ukrainian software company will face charges over cyber attack, police suggest" (in en-AU). AP. 3 July 2017. http://www.abc.net.au/news/2017-07-03/cyber-attack-charge-ukarine/8675006. 
  19. "Backdoor built in to widely used tax app seeded last week's NotPetya outbreak" (in en-us). Ars Technica. https://arstechnica.com/security/2017/07/heavily-armed-police-raid-company-that-seeded-last-weeks-notpetya-outbreak/. 
  20. Jack Stubbs, Matthias Williams (5 July 2017). "Ukraine scrambles to contain new cyber threat after 'NotPetya' attack". Reuters. https://www.reuters.com/article/us-cyber-attack-ukraine-backdoor-idUSKBN19Q14P. 
  21. "New ransomware outbreak". Kaspersky Lab. https://blog.kaspersky.com/new-ransomware-epidemics/17314/. 
  22. Brandom, Russell (27 June 2017). "A new ransomware attack is hitting airlines, banks and utilities across Europe". https://www.theverge.com/2017/6/27/15879480/petrwrap-virus-ukraine-ransomware-attack-europe-wannacry. 
  23. "MIFR-10130295". 30 June 2017. https://www.us-cert.gov/sites/default/files/publications/MIFR-10130295.pdf. 
  24. Goddin, Dan (14 April 2017). "NSA-leaking Shadow Brokers just dumped its most damaging release yet". Ars Technica. pp. 1. https://arstechnica.com/security/2017/04/nsa-leaking-shadow-brokers-just-dumped-its-most-damaging-release-yet/. 
  25. Iain Thomson (28 June 2017). "Everything you need to know about the Petya, er, NotPetya nasty trashing PCs worldwide" (in en). San Francisco. https://www.theregister.co.uk/2017/06/28/petya_notpetya_ransomware/. 
  26. "India worst hit by Petya in APAC, 7th globally: Symantec". The Economic Times. 29 June 2017. http://economictimes.indiatimes.com/tech/internet/india-worst-hit-by-petya-in-apac-7th-globally-symantec/articleshow/59367013.cms. 
  27. "Petya Ransomware Outbreak Originated in Ukraine via Tainted Accounting Software" (in en-us). BleepingComputer. https://www.bleepingcomputer.com/news/security/petya-ransomware-outbreak-originated-in-ukraine-via-tainted-accounting-software/. 
  28. Hatmaker, Taylor (28 June 2017). "In aftermath of Petya, congressman asks NSA to stop the attack if it knows how". Tech crunch. https://techcrunch.com/2017/06/28/ted-lieu-petya-notpetya-no-kill-switch/. 
  29. "Petya.2017 is a wiper not a ransomware—Comae Technologies". Comae Technologies. 28 June 2017. https://blog.comae.io/petya-2017-is-a-wiper-not-a-ransomware-9ea1d8961d3b. 
  30. Brandom, Russell (27 June 2017). "It's already too late for today's ransomware victims to pay up and save their computers". https://www.theverge.com/2017/6/27/15881110/petya-notpetya-paying-ransom-email-blocked-ransomware. 
  31. "Tuesday's massive ransomware outbreak was, in fact, something much worse" (in en-us). Ars Technica. 28 June 2017. https://arstechnica.com/security/2017/06/petya-outbreak-was-a-chaos-sowing-wiper-not-profit-seeking-ransomware/. 
  32. "Cyber-attack was about data and not money, say experts" (in en-GB). BBC News. 29 June 2017. https://www.bbc.com/news/technology-40442578. 
  33. Solon, Olivia; Hern, Alex (28 June 2017). "'Petya' ransomware attack: what is it and how can it be stopped?". The Guardian. https://www.theguardian.com/technology/2017/jun/27/petya-ransomware-cyber-attack-who-what-why-how. 
  34. Cimpanu, Catalin. "Vaccine, not Killswitch, Found for Petya (NotPetya) Ransomware Outbreak". Bleeping Computer. https://www.bleepingcomputer.com/news/security/vaccine-not-killswitch-found-for-petya-notpetya-ransomware-outbreak/. 
  35. Rogers, James (28 June 2017). "Petya ransomware: Experts tout 'vaccine' to protect computers from crippling cyber attack". Fox News. http://www.foxnews.com/tech/2017/06/28/petya-ransomware-experts-tout-vaccine-to-protect-computers-from-crippling-cyber-attack.html. 
  36. McGoogan, Cara (28 June 2017). "Security researcher creates 'vaccine' against ransomware attack". The Telegraph. https://www.telegraph.co.uk/technology/2017/06/28/security-researcher-creates-vaccine-against-ransomware-attack/. 
  37. Lee, Dave (28 June 2017). "'Vaccine' created for huge cyber-attack". BBC News. https://www.bbc.co.uk/news/technology-40427907. 
  38. "Victims keep sending money to Petya". https://twitter.com/mikko/status/880036070267772929?lang=en. "No way to contact the attackers, as their email address was killed." 
  39. "Analyzed: Internet Propagation and Recovery of Non-NTFS Victims". 26 July 2017. https://blog.alertlogic.com/blog/emergent-petrwrap-variant-analyzed-internet-propagation-and-recovery-of-non-ntfs-victims/. 
  40. Whittaker, Zack. "Six quick facts to know about today's global ransomware attack". ZDNet. http://www.zdnet.com/article/six-quick-facts-june-global-ransomware-cyberattack/. 
  41. Warren, Tom (13 May 2017). "Microsoft issues 'highly unusual' Windows XP patch to prevent massive ransomware attack". Vox Media. https://www.theverge.com/2017/5/13/15635006/microsoft-windows-xp-security-patch-wannacry-ransomware-attack. 
  42. Newman, Lily Hay. "A Scary New Ransomware Outbreak Uses WannaCry's Old Tricks". Wired. https://www.wired.com/story/petya-ransomware-outbreak-eternal-blue/. Retrieved 29 June 2017. 
  43. Greenburg, Andy (22 August 2018). "The Untold Story of NotPetya, the Most Devastating Cyberattack in History". Wired. https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/. Retrieved 1 September 2018. 
  44. Griffin, Andrew (27 June 2017). "Chernobyl's radiation monitoring system has been hit by the worldwide cyber attack". The Independent. https://www.independent.co.uk/news/world/europe/chernobyl-ukraine-petya-cyber-attack-hack-nuclear-power-plant-danger-latest-a7810941.html. 
  45. Scott, Mark; Perlroth, Nicole (27 June 2017). "New Cyberattack Spreads in Europe, Russia and U.S.". The New York Times. ISSN 0362-4331. https://www.nytimes.com/2017/06/27/technology/ransomware-hackers.html. 
  46. "US, UK say Russia behind 'most destructive' cyberattack ever". https://www.cnet.com/news/uk-said-russia-is-behind-destructive-2017-cyberattack-in-ukraine/. 
  47. "'Petya' Cyberattack Cripples Ukraine, And Experts Say It's Spreading Globally". The two way (NPR). 27 June 2017. https://www.npr.org/sections/thetwo-way/2017/06/27/534560169/large-cyberattack-hits-ukraine-snarling-electric-grids-and-airports. 
  48. "Russia's Rosneft says hit by cyber attack, oil production unaffected". Reuters. 27 June 2017. https://www.reuters.com/article/us-russia-rosneft-cyberattack-idUSKBN19I1N9. 
  49. Ruuda, Lennart (28 June 2017). "Ehituse ABC sulges küberrünnaku tõttu kõik oma poed" (in et). Postimees. http://majandus24.postimees.ee/4160147/ehituse-abc-sulges-kuberrunnaku-tottu-koik-oma-poed. 
  50. Yeomans, Jon (6 July 2017). "Dettol maker Reckitt Benckiser warns revenue will be hit as it cleans up Petya cyber attack". The Telegraph. https://www.telegraph.co.uk/business/2017/07/06/dettol-maker-reckitt-benckiser-warns-revenue-will-hit-cleans/. 
  51. "Hackerangriff: Beiersdorf & Co hart getroffen". ARD. 6 July 2017. http://boerse.ard.de/aktien/hackerangriff-beiersdorf-und-co-hart-getroffen100.html. 
  52. Henley, Jon; Solon, Olivia (27 June 2017). "'Petya' ransomware attack strikes companies across Europe and US". The Guardian. ISSN 0261-3077. https://www.theguardian.com/world/2017/jun/27/petya-ransomware-attack-strikes-companies-across-europe. 
  53. "Petya cyberattack: Hobart's Cadbury chocolate factory struck". The Australian. http://www.theaustralian.com.au/business/technology/petya-cyber-attack-hobarts-cadbury-chocolate-factory-struck/news-story/0952a26ba16b22a85da636a92393206f. 
  54. "New malware hits JNPT operations as APM Terminals hacked globally". The Indian Express. 27 June 2017. http://indianexpress.com/article/india/cyber-attack-new-malware-hits-jnpt-ops-as-apm-terminals-hacked-globally-4725102/. 
  55. Evans, Melanie (30 June 2017). "Business News: Hospital Is Forced To Scrap Computers". The Wall Street Journal. https://www.wsj.com/articles/cyberattack-forces-west-virginia-hospital-to-scrap-its-computer-systems-1498769889. 
  56. "Petya ransomware: Cyberattack costs could hit $300m for shipping giant Maersk". http://www.zdnet.com/article/petya-ransomware-cyber-attack-costs-could-hit-300m-for-shipping-giant-maersk/. 
  57. https://s1.q4cdn.com/714383399/files/doc_financials/annual/2019/FedEx-Corporation-2019-Annual-Report.pdf
  58. Uchill, Joe (28 June 2017). "Overnight Cybersecurity: New questions about 'ransomware' attack—Tensions between NSA chief, Trump over Russia—Senate panel asks states to publicize election hacks". The hill. http://thehill.com/policy/cybersecurity/overnights/339926-overnight-cybersecurity-new-ransomware-wasnt-really. 
  59. "NATO Warns Use of Article 5 Over Cyber Attack, Members Pledge Spending Increase". Haaretz. 28 June 2017. http://www.haaretz.com/world-news/europe/1.798322. 
  60. Kieran McCarthy (11 January 2019). "Cyber-insurance shock: Zurich refuses to foot NotPetya ransomware clean-up bill—and claims it's 'an act of war'". The Register. https://www.theregister.co.uk/2019/01/11/notpetya_insurance_claim/. 
  61. Lieu, Ted. "Letter to NSA director". House. https://lieu.house.gov/sites/lieu.house.gov/files/documents/6-28%20Letter%20from%20Rep.%20Lieu%20to%20Adm.%20Rogers.pdf. 
  62. "New computer virus spreads from Ukraine to disrupt world business". Reuters. 2017. https://www.reuters.com/article/us-cyber-attack-idUSKBN19I1TD. 
  63. thehill.com http://thehill.com/policy/cybersecurity/374104-trump-admin-blames-russia-for-global-cyberattack-warns-of-international
  64. "US, UK, Australia Warn Russia of 'International Consequences'—NotPetya Outbreak Attributed to the Kremlin" https://wccftech.com/australia-us-uk-russia-notpetya/
  65. "Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware and Other Disruptive Actions in Cyberspace". 19 October 2020. https://www.justice.gov/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware-and. 
  66. "UK exposes series of Russian cyber attacks against Olympic and Paralympic Games". https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games. 
More
©Text is available under the terms and conditions of the Creative Commons-Attribution ShareAlike (CC BY-SA) license; additional terms may apply. By using this site, you agree to the Terms and Conditions and Privacy Policy.
Upload a video for this entry
Information
Subjects: Others
Contributor MDPI registered users' name will be linked to their SciProfiles pages. To register with us, please refer to https://encyclopedia.pub/register :
HandWiki
View Times: 3.9K
Entry Collection: HandWiki
Revision: 1 time (View History)
Update Date: 19 Oct 2022
Table of Contents
    Notice
    You are not a member of the advisory board for this topic. If you want to update advisory board member profile, please contact office@encyclopedia.pub.
    OK
    Confirm
    Only members of the Encyclopedia advisory board for this topic are allowed to note entries. Would you like to become an advisory board member of the Encyclopedia?
    Yes
    No
    ${ textCharacter }/${ maxCharacter }
    Submit
    Cancel
    There is no comment~
    ${ textCharacter }/${ maxCharacter }
    Submit
    Cancel
    ${ selectedItem.replyTextCharacter }/${ selectedItem.replyMaxCharacter }
    Submit
    Cancel
    Confirm
    Are you sure to Delete?
    Yes No
    Academic Video Service
    Feedback