NotPetya (2017): A Supply Chain Wiper Disguised as Ransomware
Summary
NotPetya struck on June 27, 2017, initially appearing to be ransomware similar in some code lineage to the earlier Petya malware, but functioning as a destructive wiper — encrypted data could not actually be recovered even if a ransom was paid. It caused an estimated $10 billion in global damages, affecting companies including Maersk, Merck, FedEx (via its TNT Express subsidiary), and many Ukrainian organizations.
Technical Root Cause
The initial infection vector was a compromised update to M.E.Doc, Ukrainian tax and accounting software used by a large share of businesses operating in Ukraine. Attackers compromised M.E.Doc's update servers and pushed a malicious update. Once inside a network, NotPetya used the same EternalBlue SMB exploit (CVE-2017-0144) that powered WannaCry a month earlier, along with credential-harvesting techniques (Mimikatz-style extraction) to spread laterally, including to fully-patched systems reachable via stolen credentials.
Why It Mattered
NotPetya demonstrated that a supply chain compromise of a single, seemingly minor regional software vendor could cause global collateral damage to multinational companies that had no direct relationship with the initial target — most affected companies were not the intended targets but were infected through their Ukrainian operations or subsidiaries running M.E.Doc.
OWASP / CWE Mapping
- OWASP A08:2021: Software and Data Integrity Failures (compromised update mechanism)
- CWE-494: Download of Code Without Integrity Check
- Secondary spread relied on CWE-119 class issues (EternalBlue) and weak credential hygiene
Lasting Impact
NotPetya is frequently cited alongside SolarWinds as a defining supply chain attack, but predates it by three years, and is notable for combining a compromised update mechanism with a wormable exploit for maximum lateral spread. It significantly increased corporate interest in network segmentation and cyber insurance policy language around "act of war" exclusions, which became contested in NotPetya-related insurance litigation.
How Safeguard Helps
Safeguard's supply chain risk monitoring flags dependency on third-party software update channels as a risk category, complementing vulnerability scanning that would catch EternalBlue-class issues but not a compromised-but-signed update itself.
