# Petya/NotPetya Outbreak (June 2017): EternalBlue/EternalRomance (MS17-010, CVE-2017-0144/0145) Lateral Movement and M.E.Doc Update Compromise

> The June 2017 Petya (NotPetya/ExPetr/Nyetya) outbreak spread inside networks using EternalBlue and EternalRomance (MS17-010), a modified Mimikatz, PsExec and WMI/wmic.exe, and lacked WannaCry-style external IP scanning. Later analysis by FireEye, CISA and ESET traced the initial infection to a poisoned update of the Ukrainian M.E.Doc accounting software; the original Kryptos Logic post left that link unconfirmed.

- **Published:** 2026-10-17T18:44:31Z
- **Last reviewed:** 2026-10-17T18:44:31Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3831
- **ID:** TL-2026-3831
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** RESOLVED
- **Actor:** APT44
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2017-0144, CVE-2017-0145

## Description

Kryptos Logic (28 June 2017) analyzed the in-the-wild Petya outbreak and noted that, unlike WannaCry, it has no external IP scanning, so it spreads only inside a network once a foothold exists. Internal propagation used the EternalBlue exploit for MS17-010 (with ARP spam observed on LANs during exploitation), plus credential harvesting with mimikatz followed by lateral movement through PsExec, with wmic.exe as the fallback when PsExec is not possible. Kryptos Logic observed successful exploitation of Windows 7 and Windows 2012 Domain Controllers, and its Vantage Breach Intelligence Feed saw 10-15 million unique thwarted infection attempts. It stressed that a single unpatched machine or domain controller with shared administrator credentials can compromise an entire network regardless of the patch state of other hosts. The initial vectors it cited were a compromised MeDoc tax-software update system, watering-hole attacks on Ukrainian city official websites and an RTF document delivery system. The author explicitly did not confirm the MeDoc link.

Subsequent public analysis supports the supply-chain vector. FireEye reported the malware was delivered through a poisoned M.E.Doc update dated 27 June 2017, with PsExec lateral movement seen from about 10:12 UTC. The CISA alert on NotPetya (TA17-181A) states threat actors had access to the M.E.Doc development environment as early as 14 April 2017. ESET reported a backdoor injected into an M.E.Doc module and present in updates released on 14 April, 15 May and 22 June 2017. Press reporting, citing Cisco, says the operators reached the M.E.Doc update server with stolen credentials and modified its NGINX configuration to proxy connections to an actor-controlled server. Propagation mechanisms are EternalBlue, EternalRomance, PsExec, WMI and a modified Mimikatz that steals credentials from LSASS.

The payload encrypts files with a dynamically generated 128-bit AES key and modifies the master boot record so the master file table and original MBR are encrypted before a forced reboot. FireEye observed clearing of the Setup, System, Security and Application event logs with wevtutil, USN journal deletion with fsutil, scheduled-task creation with schtasks and a forced restart with shutdown.exe /r /f. The ransom note directs victims to a single Posteo email address, which was shut down, and to Bitcoin wallet 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX. Each victim gets a unique installation key, so recovery is unlikely even if the ransom is paid. Later analysis characterizes NotPetya as a wiper rather than true ransomware, and researchers have linked it to the TeleBots group; this research did not independently verify state attribution, so it is recorded at medium confidence. The incident is historical, and the root defensive control is MS17-010 (released 14 March 2017) plus limiting credential exposure.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1203 Exploitation for Client Execution
- T1047 Windows Management Instrumentation
- T1569.002 Service Execution
- T1053.005 Scheduled Task
- T1685.005 Clear Windows Event Logs
- T1003.001 LSASS Memory
- T1021.002 SMB/Windows Admin Shares
- T1078.002 Domain Accounts
- T1561.002 Disk Structure Wipe
- T1529 System Shutdown/Reboot

## Sources

- [Petya, Dead but Still Dancing - Kryptos Logic Vantage Team](https://www.kryptoslogic.com/blog/2017/06/petya-dead-but-still-dancing/)
- [CISA Alert TA17-181A: Petya Ransomware](https://cisa.gov/ncas/alerts/TA17-181A)
- [Google Cloud / FireEye: Petya Ransomware Spreading via EternalBlue Exploit](https://cloud.google.com/blog/topics/threat-intelligence/petya-ransomware-spreading-via-eternalblue-exploit)
- [CERT-EU Security Advisory 2017-014](https://www.cert.europa.eu/publications/security-advisories/2017-014/pdf)
- [Help Net Security: NotPetya outbreak - What we know so far](https://www.helpnetsecurity.com/2017/06/28/notpetya-outbreak/)
- [Tripwire: NotPetya Timeline of a Ransomworm](https://tripwire.com/state-of-security/notpetya-timeline-of-a-ransomworm)
- [SecurityWeek: NotPetya Operators Accessed M.E.Doc Server Using Stolen Credentials (Cisco)](https://www.securityweek.com/notpetya-operators-accessed-medoc-server-using-stolen-credentials-cisco)
- [Dark Reading: Updates to NotPetya Lead to Server Seizure at Ukrainian Software Firm](https://www.darkreading.com/cyberattacks-data-breaches/updates-to-notpetya-lead-to-server-seizure-at-ukrainian-software-firm)
- [Wikipedia: Petya (malware family)](https://en.wikipedia.org/wiki/Petya_(malware_family))

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3831