Threat reportRansomwareTL-2026-3831
Petya/NotPetya Outbreak (June 2017): EternalBlue/EternalRomance (MS17-010, CVE-2017-0144/0145) Lateral Movement and M.E.Doc Update Compromise
Petya/NotPetya Outbreak (June 2017) (TL-2026-3831), also tracked as Petya, is a high-severity ransomware operation, first published 2026-10-17. It is attributed to APT44 with medium confidence, affects Microsoft Windows (SMBv1, MS17-010), references 2 CVEs (CVE-2017-0144, CVE-2017-0145), maps to 11 MITRE ATT&CK techniques (T1003.001, T1021.002, T1047), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 11MITRE ATT&CK
- Actors
- 1APT44
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-3831
- Threat ID
- TL-2026-3831
- Also known as
- Petya, NotPetya, ExPetr, EternalPetya, PetrWrap, Nyetya
- Severity
- HIGH
- Status
- RESOLVED
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- APT44
- Attribution confidence
- MEDIUM
- Motivation
- DESTRUCTION
- Target sectors
- government administration, finance, energy, transport, logistics, manufacturing
- Target regions
- ukraine, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in Petya/NotPetya Outbreak (June 2017)
Malware and tooling: DoublePulsar, EternalPetya, MimiKatz, NotPetya - S0368, Petya, ETERNALBLUE, ETERNALROMANCE, NotPetya, PSEXEC, mimikatz
How Petya/NotPetya Outbreak (June 2017) works
The June 2017 Petya (NotPetya/ExPetr/Nyetya) outbreak spread inside networks using EternalBlue and EternalRomance (MS17-010), a modified Mimikatz, PsExec and WMI/wmic.exe, and lacked WannaCry-style external IP scanning. Later analysis by FireEye, CISA and ESET traced the initial infection to a poisoned update of the Ukrainian M.E.Doc accounting software; the original Kryptos Logic post left that link unconfirmed.
Kryptos Logic (28 June 2017) analyzed the in-the-wild Petya outbreak and noted that, unlike WannaCry, it has no external IP scanning, so it spreads only inside a network once a foothold exists. Internal propagation used the EternalBlue exploit for MS17-010 (with ARP spam observed on LANs during exploitation), plus credential harvesting with mimikatz followed by lateral movement through PsExec, with wmic.exe as the fallback when PsExec is not possible. Kryptos Logic observed successful exploitation of Windows 7 and Windows 2012 Domain Controllers, and its Vantage Breach Intelligence Feed saw 10-15 million unique thwarted infection attempts. It stressed that a single unpatched machine or domain controller with shared administrator credentials can compromise an entire network regardless of the patch state of other hosts. The initial vectors it cited were a compromised MeDoc tax-software update system, watering-hole attacks on Ukrainian city official websites and an RTF document delivery system. The author explicitly did not confirm the MeDoc link.
Subsequent public analysis supports the supply-chain vector. FireEye reported the malware was delivered through a poisoned M.E.Doc update dated 27 June 2017, with PsExec lateral movement seen from about 10:12 UTC. The CISA alert on NotPetya (TA17-181A) states threat actors had access to the M.E.Doc development environment as early as 14 April 2017. ESET reported a backdoor injected into an M.E.Doc module and present in updates released on 14 April, 15 May and 22 June 2017. Press reporting, citing Cisco, says the operators reached the M.E.Doc update server with stolen credentials and modified its NGINX configuration to proxy connections to an actor-controlled server. Propagation mechanisms are EternalBlue, EternalRomance, PsExec, WMI and a modified Mimikatz that steals credentials from LSASS.
The payload encrypts files with a dynamically generated 128-bit AES key and modifies the master boot record so the master file table and original MBR are encrypted before a forced reboot. FireEye observed clearing of the Setup, System, Security and Application event logs with wevtutil, USN journal deletion with fsutil, scheduled-task creation with schtasks and a forced restart with shutdown.exe /r /f. The ransom note directs victims to a single Posteo email address, which was shut down, and to Bitcoin wallet 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX. Each victim gets a unique installation key, so recovery is unlikely even if the ransom is paid. Later analysis characterizes NotPetya as a wiper rather than true ransomware, and researchers have linked it to the TeleBots group; this research did not independently verify state attribution, so it is recorded at medium confidence. The incident is historical, and the root defensive control is MS17-010 (released 14 March 2017) plus limiting credential exposure.
MITRE ATT&CK techniques used in TL-2026-3831
Credential Access
Lateral Movement
T1021.002 SMB/Windows Admin Shares
Execution
T1047 Windows Management Instrumentation; T1203 Exploitation for Client Execution; T1569.002 Service Execution
Persistence
Defense Evasion
Initial Access
T1195.002 Compromise Software Supply Chain
Impact
T1529 System Shutdown/Reboot; T1561.002 Disk Structure Wipe
defense-impairment
Affected products and versions in Petya/NotPetya Outbreak (June 2017)
- Microsoft — Windows (SMBv1, MS17-010)
Vulnerable versions: Windows 7; Windows Server 2012 (domain controllers observed exploited)
Fixed in: Systems with MS17-010 applied - Linkos Group — M.E.Doc accounting/tax software (update channel abused for initial infection)
Vulnerable versions: Updates released 2017-04-14, 2017-05-15 and 2017-06-22 per ESET
Remediation for Petya/NotPetya Outbreak (June 2017)
Patches
- MS17-010 (CVE-2017-0144, CVE-2017-0145), released 14 March 2017
Immediate actions
- Apply Microsoft MS17-010 to all Windows hosts, especially domain controllers
- Disable SMBv1 and block TCP/445 between internal segments
- Hunt for PsExec, wmic.exe /node and wevtutil cl activity originating from non-admin workstations
- Rotate shared local and domain administrator credentials and restrict credential reuse
Workarounds
- Block SMBv1 at the host firewall
- Disable WMI and remote service creation from workstation tiers where not required
Longer-term hardening
- Segment networks so a single unpatched host cannot reach domain controllers over SMB
- Deploy EDR with LSASS credential-theft and MBR-write detection
- Maintain offline, tested backups
- Vet and monitor third-party software update channels
CVEs associated with Petya/NotPetya Outbreak (June 2017)
Timeline of Petya/NotPetya Outbreak (June 2017)
- Microsoft releases MS17-010 fixing the SMBv1 flaws (CVE-2017-0144, CVE-2017-0145) later exploited by Petya.
- Per CISA and ESET, actors have access to the M.E.Doc development environment and a backdoored update is released on this date.
- ESET reports a second M.E.Doc update containing the injected backdoor.
- ESET reports a third M.E.Doc update containing the injected backdoor.
- Poisoned M.E.Doc update triggers the NotPetya outbreak; FireEye observes PsExec lateral movement from about 10:12 UTC and NCCIC is notified of events in multiple countries and sectors.
- Kryptos Logic publishes 'Petya, Dead but Still Dancing', noting no external IP scanning, internal spread via EternalBlue, mimikatz, PsExec and wmic.exe, and 10-15 million thwarted infection attempts in its feed.
- CISA publishes alert TA17-181A on Petya ransomware with mitigation guidance centered on MS17-010.
Sources cited for Petya/NotPetya Outbreak (June 2017)
- Petya, Dead but Still Dancing - Kryptos Logic Vantage Team
- CISA Alert TA17-181A: Petya Ransomware
- Google Cloud / FireEye: Petya Ransomware Spreading via EternalBlue Exploit
- CERT-EU Security Advisory 2017-014
- Help Net Security: NotPetya outbreak - What we know so far
- Tripwire: NotPetya Timeline of a Ransomworm
- SecurityWeek: NotPetya Operators Accessed M.E.Doc Server Using Stolen Credentials (Cisco)
- Dark Reading: Updates to NotPetya Lead to Server Seizure at Ukrainian Software Firm
- Wikipedia: Petya (malware family)
Detection coverage for TL-2026-3831
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3831 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.