This is an accepted version of this page
 Petya's ransom note displayed on a compromised system | |
| Date | 27–28 June 2017 (2017-06-27 –2017-06-28) |
|---|---|
| Location |  Ukraine[1] |
| Type | Cyberattack |
| Cause | Malware,ransomware,wiper,cyberterrorism |
| Outcome | Affected several Ukrainian ministries, banks, metro systems and state-owned enterprises |
| Suspects |  Russia (according to statements of Ukrainian authorities,Michael N. Schmitt andCIA)[5][6][7][8][9] |
A series of powerfulcyberattacks using thePetya malware began on 27 June 2017 that swamped websites ofUkrainian organizations, including banks, ministries, newspapers and electricity firms.[10] Similar infections were reported inFrance,Germany,Italy,Poland,Russia,United Kingdom, theUnited States andAustralia.[3][11][12]ESET estimated on 28 June 2017 that 80% of all infections were in Ukraine, with Germany second hardest hit with about 9%.[2] On 28 June 2017, theUkrainian government stated that the attack was halted.[13] On 30 June 2017, theAssociated Press reported experts agreed that Petya was masquerading asransomware, while it was actually designed to cause maximum damage, with Ukraine being the main target.[14]
Security experts believe that the NotPetya attack originated from an update of M.E.Doc, a Ukrainian tax accounting package developed by Intellect Service.[2] M.E.Doc was widely used by tax accountants and businesses in Ukraine,[15] andMikko Hyppönen, a security expert atF-Secure, described it as a primary accounting software for many Ukrainian firms.[2] Estimates suggest that M.E.Doc had about 400,000 customers across Ukraine, covering approximately 90% of domestic firms.[8]
M.E.Doc provides periodic updates to its program through an update server. On 27 June 2017, a software update was distributed via M.E.Doc's update server, after which reports of the NotPetya ransomware attack began to appear. British cybersecurity researcherMarcus Hutchins stated, "It looks like the software's automatic update system was compromised and used to download and run malware rather than updates for the software."[2] The company that develops M.E.Doc denied any intentional involvement in the ransomware attack, stating that its own systems were also affected, and that it was cooperating with law enforcement to investigate the incident.[15][16] A similar incident occurred on 18 May 2017, when the XData ransomware spread through a compromised update of M.E.Doc. Hundreds of accounting departments were affected in Ukraine.[17]
The cyberattack involved malware that resembledPetyaransomware but was later found to function as a wiper rather than traditional ransomware. Like theWannaCry ransomware attack in May 2017, NotPetya used theEternalBlue exploit, which targeted a vulnerability in older versions of theMicrosoft Windows operating system. When executed, NotPetya encrypted themaster boot record (MBR), preventing the operating system from loading. It then displayed a message demanding USD 300 inBitcoin, but researchers found that data recovery was not possible. The software also spread within networks by exploiting theServer Message Block (SMB) protocol in Windows. Additionally, NotPetya incorporatedMimikatz, a proof-of-concept tool created in 2011 to demonstrate how Windows stored passwords in memory. Attackers used it to extract credentials, escalate privileges, and move laterally across networked systems.[18]
The EternalBlue exploit had been identified before the WannaCry attack, and Microsoft issued patches in March 2017 to address the vulnerability inWindows Vista,Windows 7,Windows 8.1,Windows Server 2008,Windows Server 2012, andWindows Server 2016. Windows 10 was not affected.[19] However, WannaCry spread through systems that ran older, unsupported Windows versions or had not applied the available security patches. In response to the attack, Microsoft issued new patches forWindows XP,Windows Server 2003 andWindows 8 a day after the WannaCry attack.[19] Security expertLesley Carhart stated, "Every method of exploitation that the attack used to spread was preventable by well-documented means."[20]
Security experts determined that the variant of Petya used in the 2017 Ukraine cyberattacks had been modified and was subsequently named NotPetya or Nyetna to distinguish it from the original ransomware. NotPetya encrypted entire files, not just the Master File Table (MFT), and in some cases, functioned as a wiper, permanently destroying or irreversibly altering data, with no known method of recovery.[21][22][23] Some security experts saw that the software could intercept passwords and perform administrator-level actions that could further ruin computer files. They also noted that the software could identify specific computer systems and bypass infection of those systems, suggesting the attack was more surgical in its goal.[20] Unlike the WannaCry software, a "kill switch" was never found in NotPetya, which could have been used to immediately stop its spread.[24] According to Nicholas Weaver of theUniversity of California the hackers had previously compromised M.E.Doc "made it into a remote-control Trojan, and then they were willing to burn this asset to launch this attack."[8]
During the attack the radiation monitoring system at Ukraine'sChernobyl Nuclear Power Plant went offline.[25] Several Ukrainian ministries, banks, metro systems and state-owned enterprises (Boryspil International Airport,Ukrtelecom,Ukrposhta,State Savings Bank of Ukraine,Ukrainian Railways) were affected.[26] In the infected computers, important computer files were overwritten and thus permanently damaged, despite the malware's displayed message to the user indicating that all files could be recovered "safely and easily" by meeting the attackers' demands and making the requested payment inBitcoin currency.[27]
The attack has been seen to be more likely aimed at crippling the Ukrainian state rather than for monetary reasons.[15] The attack came on the eve of the Ukrainianpublic holiday,Constitution Day (celebrating the anniversary of the approval by theVerkhovna Rada (Ukraine's parliament) of theConstitution of Ukraine on 28 June 1996).[28][29][30] Most government offices would be empty, allowing the cyberattack to spread without interference.[15] In addition, some security experts saw the ransomware engage in wiping the affected hard drives rather than encrypting them, which would be a further disaster for companies affected by this.[15]
A short time before the cyberattack began, it was reported that a senior intelligence officer and head of a special forces detachment unit of theUkrainian Chief Directorate of Intelligence, colonelMaksym Shapoval, was assassinated inKyiv by a car bomb.[31] Former government adviser inGeorgia andMoldova Molly K. McKew believed this assassination was related to the cyberattack.[32]
On 28 June 2017 theUkrainian government stated that the attack was halted, "The situation is under complete control of the cyber security specialists, they are now working to restore the lost data."[13]
Following the initial 27 June attack, security experts found that the code that had infected the M.E.Doc update had abackdoor that could potentially be used to launch another cyberattack. On seeing signs of another cyberattack, the Ukrainian police raided the offices of M.E.Doc on 4 July 2017 and seized their servers. M.E.Doc's CEO stated that they were not aware there had been a backdoor installed on their servers, again refuted their involvement in the attack, and were working to help authorities identify the source.[33][34] Security companyESET found that the backdoor had been installed on M.E.Doc's updater service as early as 15 May 2017, while experts fromCisco Systems' Talos group found evidence of the backdoor as early as April 2017; either situation points to the cyberattack as a "thoroughly well-planned and well-executed operation".[35] Ukrainian officials have stated that Intellect Service will "face criminal responsibility", as they were previously warned about lax security on their servers by anti-virus firms prior to these events but did not take steps to prevent it.[36] Talos warned that due to the large size of the M.E.Doc update that contained the NotPetya malware (1.5 gigabytes), there may have been other backdoors that they have yet to find, and another attack could be possible.[35]
On 30 June, theSecurity Service of Ukraine (SBU) reported that it had seized equipment allegedly used to launch the cyberattack, stating that it belonged to Russian agents responsible for the attack.[37] On 1 July 2017, the SBU stated that available data indicated the perpetrators of the December 2016 attacks on Ukraine's financial system, transport and energy infrastructure, which used TeleBots andBlackEnergy,[38] were the same groups responsible for the 27 June 2017 attack. "This testifies to the involvement of the special services of Russian Federation in this attack," it concluded.[7][39] A December 2016 cyberattack on a Ukrainian state energy system caused a power outage in northern Kyiv.[7]Russia–Ukraine relations have remained strained since Russia's2014 annexation of Crimea and the subsequent conflict ineastern Ukraine, which had resulted in more than 10,000 deaths by late June 2017.[7] Russia has denied sending troops or military equipment toeastern Ukraine.[7] Ukraine has described cyberattacks on its state institutions as part of "hybrid war" waged by Russia.[7]
On 30 June 2017, cybersecurity firmESET attributed the attack to the TeleBots group, which it stated had links toBlackEnergy. "Prior to the outbreak, the Telebots group targeted mainly the financial sector. The latest outbreak was directed against businesses in Ukraine, but they apparently underestimated the malware's spreading capabilities. That's why the malware went out of control."[7] ESET had previously reported that BlackEnergy had been targeting Ukraine's cyber infrastructure since 2014.[40] In December 2016, ESET concluded that TeleBots had evolved from the BlackEnergy group and had used cyberattacks to sabotage Ukraine's financial sector during the second half of 2016.[41]
Around the time of the 4 July raid on M.E.Doc, the $10,000 in bitcoin already collected in the listed wallets for NotPetya had been withdrawn, and experts speculated it was used to buy space on the anonymousTor network. One message posted there, allegedly from the NotPetya authors, demanded 100,000 bitcoin (about $2.6 million) to halt the attack and decrypt all affected files.[33] On 5 July 2017, a second message, also allegedly from the NotPetya authors, was posted on aTor website, demanding that those seeking to decrypt their files send 100 bitcoin (approximately $250,000). The message was signed with the sameprivate key used by the original Petya ransomware, suggesting that the same group was responsible for both.[42]
According to reports cited in January 2018, the United StatesCentral Intelligence Agency claimed that Russia was responsible for the cyberattack, alleging that Russia'sMain Intelligence Directorate (GRU) had designed NotPetya.[43] Similarly, in February 2018, theUnited Kingdom Ministry of Defence accused Russia of launching the cyberattack, stating that by targeting systems in Ukraine, the attack had spread and affected major systems in the United Kingdom and elsewhere. Russia denied involvement, noting that Russian systems were also impacted by the attack.[44]
Wired technology writerAndy Greenberg, in reviewing the history of the cyberattacks, stated that the attacks were attributed to a Russian military hacker group called "Sandworm". Greenberg claimed that Sandworm was responsible for the 2016 blackouts in Kyiv, among other incidents. The group had reportedly been targeting Ukraine's financial sector, and sometime in early 2017, allegedly gained access to M.E.Doc's update servers, which were then used to distribute the malware that facilitated the cyberattack in June 2017.[18]
Companies affected includeAntonov,Kyivstar,Vodafone Ukraine,lifecell, TV channelsSTB,ICTV andATR,Kyiv Metro,UkrGasVydobuvannya (UGV),gas stations WOG,DTEK,EpiCentre K,Kyiv International Airport (Zhuliany),Prominvestbank,Ukrsotsbank,KredoBank,Oshchadbank and others,[13] with over 1,500 legal entities and individuals having contacted theNational Police of Ukraine to indicate that they had been victimized by 27 June 2017 cyberattack.[45] Oshchadbank was again fully functional on 3 July 2017.[46]Ukraine's electricity company's computers also went offline due to the attack; but the company continued to fully operate without using computers.[8]
While more than 80% of affected companies were from Ukraine,[needs update] the ransomware also spread to several companies in other geolocations, due to those businesses having offices in Ukraine and networking around the globe. Non-Ukrainian companies reporting incidents related to the attack include food processorMondelez International,[47] theAPM Terminals subsidiary of international shipping companyA.P. Moller-Maersk, theFedEx shipping subsidiaryTNT Express (in August 2017 its deliveries were still disrupted due to the attack),[48] Chinese shipping companyCOFCO Group, French construction materials companySaint Gobain,[49] advertising agencyWPP plc,[50] Heritage Valley Health System ofPittsburgh,[51] law firmDLA Piper,[52] pharmaceutical companyMerck & Co.,[53] consumer goods makerReckitt Benckiser, and software providerNuance Communications.[54] A Ukrainian police officer believes that the ransomware attack was designed to go global so as to distract from the directed cyberattack on Ukraine.[55]
The cost of the cyberattack had yet to be determined, as, after a week of its initial attack, companies were still working to mitigate the damage. Reckitt Benckiser lowered its sales estimates by 2% (about $130 million) for the second quarter primarily due to the attack that affected its global supply chain.[54][56]Tom Bossert, the Homeland Security adviser to the President of the United States, stated that the total damage was overUS$10 billion.[18] Among estimated damages to specific companies included overUS$870 million to Merck,US$400 million to FedEx,US$384 million to Saint-Gobain, andUS$300 million to Maersk.[18]
Secretary of theNational Security and Defence Council of UkraineOleksandr Turchynov claimed there were signs of Russian involvement in the 27 June cyberattack, although he did not give any direct evidence.[57] Russian officials have denied any involvement, calling Ukraine's claims "unfounded blanket accusations".[37]NATO Secretary-GeneralJens Stoltenberg vowed on 28 June 2017 that NATO would continueits support for Ukraine to strengthen itscyber defence.[58] The White House Press Secretary released a statement on 15 February 2018 attributing the attack to the Russian military, calling it "the most destructive and costly cyberattack in history."[59]
IT-businessman, chairman of the supervisory board of the Oktava Capital companyOleksandr Kardakov proposed to create civil cyber defense in Ukraine.[60]
{{cite news}}: CS1 maint: multiple names: authors list (link)