NotPetya Attack: Before and After the 2017 Wiper That Hit Maersk

The NotPetya attack of June 27, 2017 was a destructive cyber attack dressed up as ransomware, and the White House later put its worldwide damage at more than $10 billion, WIRED reported. It started inside a routine update for a Ukrainian accounting program. Within hours it had locked machines at shipping lines, drug makers, banks and hospitals, and files on those machines were unlikely ever to come back.

We have arranged this case as two snapshots set side by side. You will see what networks looked like on the morning of June 26, what broke on June 27, and what defenders changed once the cleanup was done. In the sections ahead you get:

• A timeline of the NotPetya attack in UTC and Pakistan time, from the first poisoned update to the court cases.
• A plain-language explanation of how one software update turned into a global outage.
• The reported losses at Maersk, Merck, FedEx and others, with notes on where the numbers disagree.
• Who was blamed, what evidence was offered, and how confident you can be in it.
• Eight defensive lessons you can apply to an office network in Pakistan this month.

What Was the NotPetya Attack?

The NotPetya attack used malicious software that made Windows computers unusable. The screen showed a ransom note asking for bitcoin, so early reports called it a new version of an older ransomware family named Petya. Security researchers soon gave it a new name because it did not behave like real ransomware.

The US cyber agency CISA put it bluntly in its alert TA17-181A. It said the NotPetya malware acted more like destructive malware than ransomware, that files were unlikely to be recoverable, and that the key shown to victims had no verified link to their machine. In other words, paying did not reliably buy anything. The UK government reached the same view and described the code as built mainly to disrupt, according to the Foreign Office statement of February 15, 2018.

That is why many analysts call it wiper malware: software whose real goal is to destroy, with a ransom screen used as cover. If you have read our case study on the WannaCry ransomware outbreak, you will notice a family resemblance. NotPetya arrived only six weeks later and reused one of the same Windows flaws, but it spread in more ways and caused far more lasting damage.

NotPetya Attack Timeline in UTC and Pakistan Time

The table below uses only dated events from the sources linked in this article. To get Pakistan time, add five hours to the UTC column.

One detail stands out. The patch for the main Windows flaw was available more than three months before the outbreak. Patching alone would not have saved everyone, as you will see below, but it would have removed one of the fastest routes.

Before June 27: The Conditions That Let It Spread

The NotPetya attack did not create its own openings. It used weaknesses that were already common in company networks. Looking at the "before" picture is the most useful part of this case, because the same conditions still exist in many offices today.

Trusted Updates Went Straight Into Production

M.E.Doc was accounting and tax reporting software used by organizations in Ukraine, and it updated itself from its maker's server. ESET found that a module inside three updates had been altered to include a backdoor. That backdoor collected each victim's EDRPOU number, the Ukrainian code that identifies a registered organization, plus proxy and email settings. ESET concluded the attackers probably had access to the program's source code and called the operation well planned and well executed.

Old Windows File Sharing Was Still Exposed

Many machines still ran SMBv1, an old version of Windows file sharing, without the March patch. CISA lists the EternalBlue exploit and a related exploit among the ways NotPetya moved between computers.

Admin Passwords Opened Too Many Doors

Inside many networks, the same powerful accounts could log in almost everywhere. That turned one infected PC into a key ring for the whole company.

Backups Lived on the Same Network

Maersk's experience showed the cost of this. WIRED reported that the company had roughly 150 domain controllers, the servers that hold user accounts and logins. The only usable copy of that data survived on a single machine in Ghana that happened to be offline during a power cut.

How Did NotPetya Work?

Here is the NotPetya attack at a conceptual level, the way a defender needs to understand it. We are leaving out anything that would help someone rebuild it.

1. Delivery through a supply chain. The first infections came through the M.E.Doc supply chain attack. Victims did nothing wrong. They installed an update from the vendor they trusted, as Microsoft and ESET both describe.
2. Credential theft. Once inside, the malware pulled Windows passwords from memory using a modified version of a well-known tool called Mimikatz, according to CISA. CISA called this its most effective way to spread.
3. Movement with normal admin tools. With those passwords, it used legitimate Windows management features to run itself on other machines. Security tools often trust these features, so the activity blended in.
4. Movement through unpatched file sharing. On machines missing MS17-010, the EternalBlue exploit gave it a second path that needed no password at all.
5. A forced restart and a fake ransom screen. Microsoft found the malware scheduled a reboot at least 10 minutes after infection. After the restart, the disk was scrambled and the ransom note appeared.

The combination is what made it so fast. Patching stopped the EternalBlue route, but the stolen passwords still worked on fully patched machines. WIRED reported that one large Ukrainian bank's network went down in 45 seconds. Cisco Talos researcher Craig Williams told the magazine it was "the fastest-propagating piece of malware we've ever seen."

After June 27: Ukraine, Maersk and the Global Bill

Ukraine took the first and heaviest hit from the NotPetya attack. A senior Ukrainian government official estimated that about 10 percent of all computers in the country were wiped, WIRED reported. The same report listed at least four hospitals in Kyiv, six power companies, two airports, more than 22 banks and nearly every federal agency among the victims.

The Maersk cyber attack became the best-known story outside Ukraine. WIRED reported that a single computer running M.E.Doc in the company's Odessa office was the entry point. Chair Jim Hagemann Snabe later said at the World Economic Forum in Davos that the company rebuilt 4,000 servers and 45,000 PCs in 10 days. He estimated the cost at $250 million to $300 million.

Other multinationals reported large NotPetya attack losses too. The figures below were compiled by WIRED from company disclosures:

These numbers come from different accounting methods, so treat them as a rough scale rather than an exact ranking. Merck is a good example. WIRED lists an $870 million loss, while Cybersecurity Dive reports that Merck sought $1.4 billion from insurers. A reported loss and an insurance claim measure different things, so both can be accurate.

The US government's own figures are narrower. The Justice Department said the three victims named in its indictment alone lost nearly $1 billion. Those three were Heritage Valley Health System, a Pennsylvania hospital network; TNT Express; and a large US drug maker. At Heritage Valley, patient lists, histories and lab records became unavailable, and critical systems stayed down for about a week.

Who Was Blamed for NotPetya, and on What Evidence?

Several separate sources point in the same direction on who ran the NotPetya attack. It helps to sort them by type.

• Government attribution (an official assessment). On February 15, 2018, the UK said its National Cyber Security Centre judged the Russian military "almost certainly" responsible. The same day, the White House press secretary blamed Russia's military and called NotPetya the most destructive and costly cyber attack in history.
• Criminal charges (allegations, not convictions). In October 2020, a federal grand jury in Pittsburgh indicted six officers of GRU Unit 74455, a group widely tracked by researchers as the Sandworm hackers. The DOJ alleges that four of them built parts of NotPetya. The officers live in Russia, and the charges have not been tested in court.
• Vendor analysis (technical evidence). ESET linked the attack to a group it calls TeleBots, which it had already tied to earlier attacks on Ukraine.

So how sure is anyone? Two governments made formal public statements, and a third source, an indictment, names individuals. That is stronger than most attribution you will read about. Still, an indictment is a set of accusations. Until a court hears the evidence, "alleged" is the right word for the named officers.

Before and After NotPetya: What Changed for Defenders

This is the comparison at the center of the case. The "before" column describes conditions reported in the sources above. The "after" column describes the defensive practice the case argues for.

What Happened in Court and With Insurers?

The NotPetya attack is unusual because its biggest legal fight was not about the attackers. It was about who pays. Merck's property policies were all-risk policies, but its insurers pointed to an exclusion for hostile or warlike action. They argued that an attack blamed on a state's military counted.

The courts disagreed. Cybersecurity Dive reports that Merck won in a New Jersey court, and that a state appeals court ruled in May 2023 that the war exclusion did not apply to these facts. Merck then settled with its insurers in January 2024, just before oral arguments at the New Jersey Supreme Court. The terms were not disclosed. Mondelez settled its own insurance case over NotPetya claims of more than $100 million in 2022, the same report says.

For the six GRU officers, nothing further has happened in court. The charges stand, but nobody has been arrested.

What Does NotPetya Mean for Businesses in Pakistan?

You do not need a link to Ukraine to learn from this case. The entry point was ordinary business software that updated itself, and most Pakistani offices run several programs like that: accounting packages, payroll tools, tax filing utilities, remote support agents and antivirus consoles.

The conditions that made the NotPetya attack so costly are also familiar. Shared admin passwords, flat office networks and backups kept on a server in the same room are common in small and mid-sized firms. Pakistan's own experience with the FBR cyber attack in 2021 showed how long recovery takes when a central data centre goes down.

The supply chain angle also links NotPetya to the SolarWinds hack, where a trusted update was again the way in. And if your organization still has old Windows machines on the network, remember that EternalBlue was the shared thread between WannaCry and NotPetya. A patch released in March 2017 is not old news if one forgotten PC in a back office still lacks it.

Eight Defensive Lessons From the NotPetya Attack

These lessons follow CISA's guidance and the failures described above. Start at the top and work down.

1. Keep an offline copy of what you cannot rebuild. That includes your domain controller or identity data, not only files. Test a restore at least once a quarter.
2. Patch and switch off old protocols. Confirm MS17-010 is installed everywhere, and disable SMBv1 where nothing depends on it.
3. Use least privilege. Give staff normal accounts for daily work. Keep admin rights for a few named people, with separate logins.
4. Use unique local admin passwords. If every PC shares one local admin password, one stolen password opens them all.
5. Segment the network. Block direct traffic between ordinary workstations, and separate accounts, production and guest Wi-Fi.
6. Limit remote admin tools. CISA recommends restricting remote management features and blocking them where they are not needed.
7. Treat vendor software as a risk. Keep a list of programs that update themselves and can reach the whole network. Watch for odd behavior after updates.
8. Plan to run without computers for a week. Maersk needed 10 days just to rebuild its servers and PCs. Decide in advance how your team will take orders, pay staff and contact customers.

If you want a personal-device version of these habits, read our checklist of warning signs on a compromised phone for your own accounts.

Rebuilding a Wiper Case Step by Step at PSTA

Cases like the NotPetya attack are part of how we teach defense. The PSTA cyber security and ethical hacking program lasts 12 weeks, is pitched at beginners, and its page lists seven modules. Incident response sits in Module 5, next to malware analysis and threat intelligence. The last module, Module 7, pairs case studies drawn from real attacks with a closing security project.

In practice, that means you work through questions like the ones in this article. What was the entry point? Which control would have slowed the spread? What should the incident timeline look like? You practice in isolated lab machines, never on real networks. You can join the batch in person at our Abbottabad campus, or attend live sessions online from any city.

If you already have the foundations and want to go deeper into testing, our advanced penetration testing track comes next. If you are weighing exams such as Security+, our beginner certification comparison lays out the order to take them. For the case that opened this series, read how the Binance hack unfolded in 2026.

Find Your Last Offline Backup Before Month-End

Here is one practical action. Before the end of this month, ask whoever runs your office systems a single question: "If every connected computer were wiped tonight, which copy would we restore from, and when did we last test it?" If the answer is unclear, that is your first project. Maersk's login data survived only because one server happened to be offline. You can make that a plan instead of luck.