{
  "family": "petya",
  "sample_count": 121,
  "category": "ransomware",
  "description": "Ransomware:Win32/Petya (and its destructive variant NotPetya) represents a paradigm shift in cyber warfare, blending ransomware extortion tactics with master boot record (MBR) corruption and lateral movement capabilities.<br><br><b>Understanding Petya</b><br>To the average user, a Petya infection is immediately devastating: the system suddenly reboots, displaying a fake CHKDSK screen before dropping a red skull-and-crossbones ASCII art with a ransom demand. For cybersecurity experts, Petya is a highly sophisticated payload that fundamentally breaks the operating system. Unlike traditional file-encrypting ransomware (crypto-ransomware), original Petya overwrites the MBR and encrypts the Master File Table (MFT) of the NTFS file system, preventing the OS from booting entirely.<br><br><b>Execution and NotPetya Variations</b><br>The 2017 variant, widely known as NotPetya, was distributed via a compromised update mechanism in the Ukrainian accounting software M.E.Doc. NotPetya combined the MBR encryption payload with the leaked EternalBlue (CVE-2017-0144) and EternalRomance SMB exploits to rapidly propagate across flat networks. Most critically, NotPetya was a <i>wiper</i> disguised as ransomware; the generated installation key was random, meaning even if the victim paid the ransom, the data was mathematically unrecoverable.<br><br><b>Indicators of Compromise & Impact</b><br>Incident responders should look for unexpected system reboots, the presence of the <code>perfc.dat</code> file in the <code>C:\\Windows</code> directory, and unauthorized use of tools like PsExec or WMI for lateral movement. The impact is catastrophic, often resulting in total organizational paralysis, supply chain disruption, and millions of dollars in irrecoverable data loss.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1047",
    "T1561.002",
    "T1569.002",
    "T1490",
    "T1210"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1561.002",
      "name": "Disk Wipe: Disk Structure Wipe",
      "tactic": "Impact"
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactic": "Impact"
    },
    {
      "id": "T1210",
      "name": "Exploitation of Remote Services",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1047",
      "name": "Windows Management Instrumentation",
      "tactic": "Execution"
    },
    {
      "id": "T1569.002",
      "name": "System Services: Service Execution",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Instantly sever network connections to infected endpoints to halt the lateral spread via SMB (EternalBlue).",
    "If a machine suddenly reboots and displays a fake CHKDSK screen, immediately power it off. This interrupts the MFT encryption process, potentially saving the data.",
    "Deploy global firewall rules to block lateral SMB traffic (TCP port 445) across internal subnets.",
    "Do not pay the ransom; in NotPetya variants, the decryption key mechanism is intentionally broken and recovery is impossible."
  ],
  "what_to_avoid": [
    "Do not allow the fake CHKDSK process to complete; powering off the machine during this phase is the only way to stop the encryption.",
    "Avoid relying solely on patching to stop the spread; NotPetya also leverages stolen credentials (via Mimikatz) to propagate to fully patched systems."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}