Anatomy of a Breach: NotPetya — The $10 Billion Attack That Masqueraded as Ransomware

$10 billion in damage. Disguised as ransomware. Designed for destruction.

On 27 June 2017, a malware outbreak began in Ukraine and spread globally within hours. Initially mistaken for a variant of the Petya ransomware — hence 'NotPetya' — the malware encrypted the master boot records of infected computers and demanded a $300 Bitcoin ransom. But analysis quickly revealed that NotPetya was not ransomware at all: its encryption was irreversible by design. The payment mechanism was non-functional. The key generation was broken intentionally. NotPetya was a destructive cyber weapon — attributed to Russia's GRU military intelligence — masquerading as ransomware to create confusion.

NotPetya's initial infection vector was a poisoned software update from M.E.Doc — a Ukrainian accounting and tax-filing application used by approximately 80% of Ukrainian businesses. The compromised update installed NotPetya on every M.E.Doc customer's systems simultaneously. From there, NotPetya used EternalBlue and Mimikatz (a credential-harvesting tool) to spread laterally through corporate networks at devastating speed. Any multinational company with operations in Ukraine — or network connectivity to Ukrainian partners — was exposed. The result was the most expensive cyber attack in history: over $10 billion in total global damage.

Global corporations brought to their knees in hours.

One software update. Every company doing business in Ukraine.

NotPetya's initial infection vector — a poisoned M.E.Doc update — was the most consequential supply chain attack in history. M.E.Doc was effectively mandatory for doing business in Ukraine (it was used for mandatory tax filings), meaning every multinational with Ukrainian operations was exposed. Maersk had a single office in Odessa. Through that office's M.E.Doc connection, NotPetya reached Maersk's entire global network — destroying 49,000 laptops and 4,000 servers across 130 countries.

When destruction is the goal, only resilience survives.

NotPetya proved that prevention alone is insufficient against destructive nation-state attacks delivered through trusted supply chains. The defence requires resilience: immutable offline backups (tested regularly), network segmentation (limiting blast radius), incident response plans (tested and rehearsed), and the recognition that any software vendor, any business partner, any country you operate in could be the vector for the next supply chain attack.

Our infrastructure penetration testing validates segmentation, backup integrity, and recovery procedures. Red team engagements simulate destructive attack scenarios. Cyber Essentials mandates patching and baseline controls. SOC in a Box detects lateral movement and wiper deployment. And UK Cyber Defence provides the crisis management and incident response capability that organisations need when everything is destroyed and the question is: can we rebuild?

Related Articles