NotPetya: the screen demands a ransom, but the real goal is to destroy

On June 27, 2017, businesses saw their computers become unusable. The screen looks like a ransom note. Yet NotPetya is not just a criminal decryption service: its behavior aims to make data and systems difficult or impossible to restore by this route.

Microsoft is seeing initial infections from the process of updating the Ukrainian accounting software M.E.Doc. A normal, expected, and allowed function becomes a way to introduce the hostile program. It can then progress in the networks by combining several techniques, including the use of access already present.

The important point is this combination. Applying a fix to a single vulnerability is not necessarily enough to stop all the ways that destructive software can flow from a compromised workstation. The relations between machines also contribute to the scale of the crisis.

Massive unavailability reveals the attack. Victims isolate systems and rebuild their environments from healthy resources. Logistical, industrial and administrative activities are disrupted far beyond Ukraine.

In its 2020 indictment, the DOJ attributes NotPetya to Russian military intelligence officers associated with the unit known as Sandworm. It accounts for nearly $1 billion in losses for only three victims in the case. This is damage taken, not a billion taken by the attackers.

NotPetya illustrates a form of cyberattack where the appearance of extortion masks sabotage. The question is no longer just how much the hacker wants to receive, but how many organizations can continue to operate after it passes.