NotPetya

Malware
14 incidents First seen 2026-01-27 Last seen 2026-10-22
Also known as
ExPetrDiskcoder.CGoldenEyePetrwrapNyetya
Overview

NotPetya is malware that was used by Sandworm Team in a worldwide attack starting on June 27, 2017. While NotPetya appears as a form of ransomware, its main purpose was to destroy data and disk structures on compromised systems; the attackers never intended to make the encrypted data recoverable. As such, NotPetya may be more appropriately thought of as a form of wiper malware. NotPetya contains worm-like features to spread itself across a computer network using the SMBv1 exploits EternalBlue and EternalRomance.

Investigate in CTI Graph Login required Open in Dashboard
Threat ecosystem
Actors Malware Campaigns CVEs
Tap a node for a quick look · double-tap to open its profile
At a glance
peak priority 140 19 techniques 1 groups use it Windows in ATT&CK since 2019-03-26 updated 2025-04-16 · v2.0
Activity by month (incidents)
2026-012026-10
Sectors targeted
government · 4manufacturing · 3education · 2energy · 2finance · 2health · 2logistics · 2technology · 2maritime · 1telecommunications · 1
Countries targeted
US · 12CA · 9RU · 8UA · 7GB · 5AU · 3NZ · 3CN · 2DK · 2FI · 2IR · 2AF · 1
Origin
IR · 5UA · 5IL · 4CA · 3CN · 3RU · 3
Kinds of incident
Malware & Botnets · 5Industry & Policy · 4Cyberattack (general) · 2Ransomware & Extortion · 2State-Sponsored & Espionage · 2Critical Infrastructure & OT · 1
Techniques seen in incidents
Ransomware · 10Espionage · 5Lateral Movement · 3Phishing · 3Cryptojacking · 2Exfiltration · 2Extortion · 2Reconnaissance · 2Social Engineering · 2T1588.001 - Malware · 2Wiper · 2Botnet · 1Data Breach · 1Data Leak · 1
Related actors
APT28 · 1Salt Typhoon · 1Scattered Spider · 1Star Blizzard · 1
Related CVEs
CVE-2021-35394 · 1CVE-2026-102764 · 1CVE-2026-20079 · 1CVE-2026-20212 · 1CVE-2026-20293 · 1CVE-2026-20316 · 1CVE-2026-31431 · 1CVE-2026-33197 · 1CVE-2026-6485 · 1CVE-2026-73453 · 1
ATT&CK techniques by tactic (19)
initial access T1078.003 Local Accounts
execution T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1569.002 Service Execution
persistence T1053.005 Scheduled Task T1078.003 Local Accounts
privilege escalation T1053.005 Scheduled Task T1078.003 Local Accounts
credential access T1003.001 LSASS Memory
discovery T1083 File and Directory Discovery T1518.001 Security Software Discovery
lateral movement T1021.002 SMB/Windows Admin Shares T1210 Exploitation of Remote Services
impact T1486 Data Encrypted for Impact T1529 System Shutdown/Reboot
defense impairment T1685.005 Clear Windows Event Logs
stealth T1036 Masquerading T1078.003 Local Accounts T1218.011 Rundll32
Groups that use it
Sandworm Team
Incident timeline
2026-10-22
Talos Intelligence HackRead AlienVault OTX SecurityWeek Dark Reading AlienVault OTX BleepingComputer The Hacker News AlienVault OTX AlienVault OTX AlienVault OTX AlienVault OTX
2026-10-12
No Identity, No Recovery: Cyber Resilience Starts With IAM
Dark Reading
2026-09-03
Schneier on Security Security Affairs
2026-07-09
New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware
The Hacker News
2026-07-09
As Global Conflicts Go Digital, Businesses Need Wartime Gameplans
Dark Reading
2026-06-05
Adaptive, Agentic AI Worms Loom as Next Enterprise Threat
Dark Reading
2026-06-05
Adaptive, Agentic AI Worms Loom as Next Enterprise Threat
Dark Reading
2026-05-28
Focus on Cyber Insurance: How Quantifying Risk Is Reshaping Security
Dark Reading
2026-04-29
Lotus Wiper Attack Targets Venezuelan Energy Firms, Utilities
Dark Reading
2026-04-17
Coast Guard's New Cybersecurity Rules Offers Lessons for CISOs
Dark Reading
2026-03-25
Blame Game: Why Public Cyber Attribution Carries Risks
Dark Reading
2026-03-19
Dark Reading Dark Reading
2026-03-03
Possible U.S.-developed exploits linked to first known ‘mass’ iOS attack
CyberScoop
2026-01-27
Eeny, meeny, miny, moe? How ransomware operators choose victims
Sophos News