MITRE ATT&CKsoftware (malware)

S0368 NotPetya

Published 2019-03-26 Modified 2025-04-16 Official page ↗
Domain
enterprise, ics
Platforms
Windows
Aliases
ExPetr, Diskcoder.C, GoldenEye, Petrwrap, Nyetya
Version
2.0
Created
2019-03-26

Description

NotPetya is malware that was used by Sandworm Team in a worldwide attack starting on June 27, 2017. While NotPetya appears as a form of ransomware, its main purpose was to destroy data and disk structures on compromised systems; the attackers never intended to make the encrypted data recoverable. As such, NotPetya may be more appropriately thought of as a form of wiper malware. NotPetya contains worm-like features to spread itself across a computer network using the SMBv1 exploits EternalBlue and EternalRomance.

Related

Uses · MITRE ATT&CK (17)

  • T1685.005 Clear Windows Event Logs sub-technique
  • T0828 Loss of Productivity and Revenue technique
  • T0866 Exploitation of Remote Services technique
  • T0867 Lateral Tool Transfer technique
  • T1078.003 Local Accounts sub-technique
  • T1569.002 Service Execution sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1218.011 Rundll32 sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1529 System Shutdown/Reboot technique
  • T1486 Data Encrypted for Impact technique
  • T1210 Exploitation of Remote Services technique
  • T1036 Masquerading technique
  • T1047 Windows Management Instrumentation technique
  • T1083 File and Directory Discovery technique

Referenced by MITRE ATT&CK · uses (1)

  • G0034 Sandworm Team group

References