NotPetya: The M.E.Doc Tax Update That Froze Maersk and Cost $10 Billion

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

On June 27, 2017, radiation monitoring screens at Chernobyl went dark, Maersk's global shipping operations froze, and a chocolate factory in Tasmania stopped. The weapon descended from Petya, ransomware discovered in March 2016 that overwrote the master boot record, showed a fake CHKDSK repair screen while encrypting the master file table, and demanded Bitcoin; a May 2016 version added a fallback payload called Mischa for machines without admin rights. Its authors borrowed from the 1995 Bond film GoldenEye, selling it as Janus Cybercrime Solutions and using an avatar of the hacker Boris Grishenko.

The 2017 attack arrived through a compromised update to M.E.Doc, the standard Ukrainian tax software, whose backdoor ESET says sat dormant for at least six weeks before firing on the eve of Ukraine's Constitution Day. Police who raided M.E.Doc found servers not updated since 2013. The malware spread with EternalBlue, an exploit attributed to the NSA and leaked by the Shadow Brokers in April 2017, plus a modified Mimikatz and PsExec. Kaspersky named it NotPetya: its encryption could not be reversed, and its $300 ransom went to one fixed Bitcoin wallet with a Posteo email account that was quickly suspended.

• About 80 percent of infections were in Ukraine, hitting the National Bank, government ministries and the metro.
• Maersk reported $200 million to $300 million in lost revenue and FedEx a $400 million hit, India's JNPT port stopped, and Princeton Community Hospital in West Virginia replaced its entire network.
• The White House put global damages above $10 billion.
• Zurich American Insurance refused Mondelez's claim under an act of war exclusion; Mondelez sued for $100 million in 2018 and settled in 2022.
• The U.S., U.K. and Australia blamed the GRU's Sandworm group, Kremlin spokesman Dmitry Peskov denied it, and NATO's Jens Stoltenberg warned such an attack could trigger Article 5.