Six years ago, the cybersecurity world was shaken by the NotPetya cyber attack, a destructive malware that caused widespread damage to businesses and governments worldwide. This attack, initially disguised as ransomware, quickly revealed its true intentions of disruption and destruction, resulting in billions of dollars in losses. Even to this day, the impact of the NotPetya attack is still being felt, and the lessons learned continue to shape the approach to cybersecurity.
The NotPetya attack first emerged in June 2017, primarily targeting organizations in Ukraine. However, it soon became apparent that this cyber threat was not limited to a specific region as it rapidly spread across various countries. At its core, the attack relied on the EternalBlue exploit (CVE-2017-0144), which leveraged a vulnerability in the SMB protocol of Windows systems. This exploit, originally developed by the National Security Agency (NSA) and later leaked by a hacking group called Shadow Brokers, allowed for remote code execution without user interaction.
NotPetya employed a multi-stage infection process upon infecting a system. It would exploit the EternalBlue vulnerability to gain initial access and then escalate privileges and move laterally within the network using credential theft techniques. The malware would also use legitimate administrative tools to propagate across interconnected systems. Its primary objective was to disrupt operations and destroy data rather than generate financial gain. Once inside a network, NotPetya would overwrite the master boot record (MBR) and the master file table (MFT), rendering the affected systems inoperable. It then displayed a ransom note, demanding a Bitcoin payment for the decryption key. However, the attackers’ email address had been shut down, making it impossible for victims to communicate and recover their data.
The impact of NotPetya was felt globally, with businesses and governments in over 60 countries affected. Shipping giant Maersk reported staggering damages of $300 million, and even critical infrastructure, such as the Chernobyl nuclear power plant, experienced disruptions. The attack posed challenges in distinguishing cyber attacks as acts of war. Zurich Insurance Group, for instance, refused to pay a $100 million claim for damages caused by the NotPetya attack, arguing that it was an Act of War. However, a judge rejected this argument, stating that the cyber attack did not fall under the clause protecting Zurich from paying out for losses caused by hostile or warlike actions.
Six years later, while the number of computers still vulnerable to EternalBlue is extremely low, around 74% of organizations still have at least one vulnerable device in their network. This highlights the ongoing relevance of patching this vulnerability, as Armis detects between a few hundred to a few thousand exploit attempts of EternalBlue every day.
NotPetya was a turning point in cyber warfare, blurring the lines between ransomware and state-sponsored cyber operations. It demonstrated the potential for highly destructive malware to cause widespread economic and operational disruptions, posing significant risks to national security and global stability.
The attack also provided important lessons for cybersecurity practices. Effective vulnerability management, including promptly applying security patches and conducting regular vulnerability assessments, is crucial in mitigating the risks of similar devastating attacks. Asset visibility, by maintaining an up-to-date inventory of networked systems, allows organizations to identify potential weak points and strengthen their defenses. Network segmentation also plays a vital role in containing the impact of cyber attacks, limiting the lateral movement of malware and preventing widespread damage.
The NotPetya cyber attack serves as a constant reminder of the evolving threats faced in the digital age. Organizations must invest in robust cybersecurity practices, such as asset visibility, vulnerability management, and network segmentation. By adopting a proactive and comprehensive approach, they can fortify their defenses and mitigate the risks posed by increasingly sophisticated cyber adversaries.