The Untold Story of NotPetya, the Most Devastating Cyberattack in History (2018)

On a June afternoon Maersk’s offices filled with employees watching screens go black and display fake ransom demands as a worm spread through corporate networks, forcing a frantic two-hour global shutdown that left ships idle, phones dead, and workers sent home. The outbreak began in Kyiv when attackers hijacked the update servers of M.E.Doc, Ukraine’s ubiquitous accounting software, turning routine updates into a delivery mechanism. That compromise built on years of Russian cyberoperations against Ukraine by the Sandworm group, which had previously knocked out data and caused power outages, and it transformed a localized sabotage campaign into a crisis that hit multinational supply chains and critical services.

The malware, dubbed NotPetya, married two powerful tools - EternalBlue, an NSA-developed Windows exploit leaked earlier in 2017, and Mimikatz, a credential-stealing utility - to propagate automatically and hop across networks, even into patched systems. It masqueraded as ransomware but was a destructive wiper that irreversibly corrupted master boot records, making recovery impossible and rendering ransom payments moot. Within hours it spread worldwide, crippling companies such as Maersk, Merck, TNT Express, Saint-Gobain, Mondelez, and Reckitt Benckiser, and even striking Russia’s Rosneft, causing more than $10 billion in damages and constituting a decisive act of cyberwarfare.