View source for 2017 Ukraine ransomware attacks

{{short description|Series of powerful cyberattacks using the Petya malware}}
{{Infobox event
| title                    = 2017 Ukraine ransomware attacks
| image                    = PetyaA.jpg
| image_size               = 300px
| image_alt                = 
| caption                  = Petya's ransom note displayed on a compromised system
| native_name              = 
| native_name_lang         =
| english_name             = 
| time                     =
| duration                 =
| date                     = {{start and end dates|df=yes|2017|6|27|2017|6|28}}
| venue                    =
| location                 = {{UKR}}<ref name= teleg>{{cite news | url= https://www.telegraph.co.uk/news/2017/06/27/ukraine-hit-massive-cyber-attack1/ | title= Petya cyber attack: Ransomware spreads across Europe with firms in Ukraine, Britain and Spain shut down | date= 27 June 2017 | first1= James | last1= Rothwell | first2= James | last2= Titcomb | first3= Cara | last3= McGoogan | work= The Daily Telegraph | access-date= 5 April 2018 | archive-date= 16 February 2018 | archive-url= https://web.archive.org/web/20180216015601/http://www.telegraph.co.uk/news/2017/06/27/ukraine-hit-massive-cyber-attack1/ | url-status= live }}</ref>
{{Collapsible list
|title=Other locations
| {{RUS}}
| {{GER}}<ref name=BBCUkb80 />
| {{USA}}<ref name= teleg />
| {{UK}}<ref name= teleg />
| {{ESP}}
| {{IND}}
| {{POL}}<ref name=teleg />
| {{ITA}}
| {{ISR}}<ref name=teleg />
| {{BLR}}<ref name= teleg />
| {{ARG}}<ref name=Turner />
| {{NED}}<ref name= Turner />
| {{AUS}}<ref>{{cite news|title=Businesses warned again to update patches as Petya ransomware hits Australian offices|url=http://www.afr.com/technology/web/security/businesses-warned-to-act-as-petya-ransomware-hits-australian-offices-20170627-gx00de|access-date=3 July 2017|work=Financial Review|date=28 June 2017|archive-date=30 June 2017|archive-url=https://web.archive.org/web/20170630232536/http://www.afr.com/technology/web/security/businesses-warned-to-act-as-petya-ransomware-hits-australian-offices-20170627-gx00de|url-status=live}}</ref>
}}
| coordinates              = <!-- {{coord |LAT|LON|region:XXXX_type:event|display=inline, title}} -->
| also_known_as            =
| type                     = [[Cyberattack]]
| theme                    = 
| cause                    = [[Malware]], [[Ransomware|ransomware]], [[Cyberterrorism|cyberterrorism]]
| first_reporter           =
| budget                   =
| patron                   = <!-- or |patrons= -->
| organisers               = <!-- or |organizers= -->
| filmed_by                =
| participants             =
| outcome                  = Affected several Ukrainian ministries, banks, metro systems and state-owned enterprises
| casualties1              =
| casualties2              =
| casualties3              =
| reported deaths          =
| reported injuries        =
| reported missing         =
| reported property damage =
| burial                   =
| inquiries                =
| inquest                  =
| coroner                  =
| arrests                  =
| suspects                 = {{RUS}} (according to statements of Ukrainian authorities, {{wipe|United States}} Michael N. Schmitt and the CIA.)<ref>{{cite web|url= http://www.rnbo.gov.ua/en/news/2821.html|title= Oleksandr Turchynov: One of the mechanisms for spreading a dangerous computer virus was a system for updating the accounting software – National Security and Defense Council of Ukraine|website= RNBO|access-date= 30 June 2017|archive-url= https://web.archive.org/web/20171019075903/http://www.rnbo.gov.ua/en/news/2821.html|archive-date= 19 October 2017|url-status= dead}}</ref><ref>{{cite web|url= https://ssu.gov.ua/en/news/1/category/21/view/3660|title= SBU establishes involvement of the RF special services into Petya.A virus-extorter attack|website= Security Service of Ukraine|access-date= 4 July 2017|archive-date= 19 October 2017|archive-url= https://web.archive.org/web/20171019075905/https://ssu.gov.ua/en/news/1/category/21/view/3660|url-status= dead}}</ref><ref name="SBU 1 July 2017" /><ref name=BBCUca26717>{{Cite news|url=https://www.bbc.com/news/technology-40706093|title=Ukraine braces for further cyber-attacks|last=Borys|first=Christian|date=26 July 2017|work=BBC News|access-date=26 July 2017|language=en-GB|archive-date=26 July 2017|archive-url=https://web.archive.org/web/20170726100438/http://www.bbc.com/news/technology-40706093|url-status=live}}</ref><ref>[https://www.washingtonpost.com/world/national-security/russian-military-was-behind-notpetya-cyberattack-in-ukraine-cia-concludes/2018/01/12/048d8506-f7ca-11e7-b34a-b85626af34ef_story.html Russian military was behind ‘NotPetya’ cyberattack in Ukraine, CIA concludes] {{Webarchive|url=https://web.archive.org/web/20180113094658/https://www.washingtonpost.com/world/national-security/russian-military-was-behind-notpetya-cyberattack-in-ukraine-cia-concludes/2018/01/12/048d8506-f7ca-11e7-b34a-b85626af34ef_story.html |date=13 January 2018 }} Washington Post, 2018</ref>
| accused                  =
| convicted                =
| charges                  =
| trial                    =
| verdict                  =
| convictions              =
| sentence                 =
| publication_bans         =
| litigation               =
| awards                   =
| url                      =
| notes                    =
}}
A series of powerful [[Cyberattack|cyberattack]]s using the [[Engineering:Petya (malware)|Petya]] malware began on 27 June 2017 that swamped websites of {{wipe|Ukraine}} organizations, including banks, ministries, newspapers and electricity firms.<ref>{{Cite news|url=https://www.reuters.com/article/us-ukraine-cyber-attacks-idUSKBN19I1IJ|title=Ukrainian banks, electricity firm hit by fresh cyber attack|last=Prentice|first=Alessandra|date=27 June 2017|work=Reuters|access-date=27 June 2017|archive-date=16 July 2019|archive-url=https://web.archive.org/web/20190716014712/https://www.reuters.com/article/us-ukraine-cyber-attacks-idUSKBN19I1IJ|url-status=live}}</ref> Similar infections were reported in {{wipe|France}}, {{wipe|Germany}}, Italy, {{wipe|Poland}}, {{wipe|Russia}}, {{wipe|United Kingdom}}, the {{wipe|United States}} and {{wipe|Australia}}.<ref name= Turner>{{cite web |url= https://www.bloomberg.com/news/articles/2017-06-27/ukraine-russia-report-ransomware-computer-virus-attacks |title= New Cyberattack Goes Global, Hits WPP, Rosneft, Maersk |last1= Turner |first1= Giles |last2= Verbyany |first2= Volodymyr |date= 27 June 2017 |website= Bloomberg |access-date= 27 June 2017 |last3= Kravchenko |first3= Stepan |archive-date= 5 November 2019 |archive-url= https://web.archive.org/web/20191105134354/https://www.bloomberg.com/news/articles/2017-06-27/ukraine-russia-report-ransomware-computer-virus-attacks |url-status= live }}</ref><ref>{{Cite news|url=https://www.nytimes.com/2017/06/27/technology/ransomware-hackers.html|title=Cyberattack Hits Ukraine Then Spreads Internationally|last1=Scott|first1=Nicole Perlroth, Mark|date=27 June 2017|work=The New York Times|access-date=4 July 2017|last2=Frenkel|first2=Sheera|language=en-US|issn=0362-4331|archive-date=13 April 2018|archive-url=https://web.archive.org/web/20180413005050/https://mobile.nytimes.com/2017/06/27/technology/ransomware-hackers.html|url-status=live}}</ref><ref>{{Cite news|url=https://www.bbc.com/news/technology-40416611|title=Global ransomware attack causes chaos|date=27 June 2017|work=BBC News|access-date=27 June 2017|archive-date=27 June 2017|archive-url=https://web.archive.org/web/20170627135748/http://www.bbc.com/news/technology-40416611|url-status=live}}<br />{{Cite magazine|url=https://www.wired.co.uk/article/petya-malware-ransomware-attack-outbreak-june-2017|title=There's another 'worldwide' ransomware attack and it's spreading quickly|last=Burgess|first=Matt|magazine=Wired UK|access-date=27 June 2017|archive-date=31 December 2017|archive-url=https://web.archive.org/web/20171231121401/http://www.wired.co.uk/article/petya-malware-ransomware-attack-outbreak-june-2017|url-status=live}}</ref> [[Company:ESET|ESET]] estimated on 28 June 2017 that 80% of all infections were in Ukraine, with Germany second hardest hit with about 9%.<ref name=BBCUkb80>{{Cite news|url=https://www.bbc.com/news/technology-40428967|title=Tax software blamed for cyber-attack spread|date=28 June 2017|work=BBC News|access-date=28 June 2017|archive-date=28 June 2017|archive-url=https://web.archive.org/web/20170628134132/http://www.bbc.com/news/technology-40428967|url-status=live}}</ref> On 28 June 2017, the Ukrainian government stated that the attack was halted.<ref name=Ukrif28617 /> On 30 June 2017, the Associated Press reported experts agreed that Petya was masquerading as [[Ransomware|ransomware]], while it was actually designed to cause maximum damage, with Ukraine being the main target.<ref>{{Cite news|url=https://www.apnews.com/ce7a8aca506742ab8e8873e7f9f229c2/Companies-still-hobbled-from-fearsome-cyberattack|title=Companies still hobbled from fearsome cyberattack|date=30 June 2017|work=Associated Press|access-date=3 July 2017|archive-date=19 October 2017|archive-url=https://web.archive.org/web/20171019080405/https://www.apnews.com/ce7a8aca506742ab8e8873e7f9f229c2/Companies-still-hobbled-from-fearsome-cyberattack|url-status=live}}</ref>

== Approach ==
Security experts believe the attack originated from an update of a Ukrainian tax accounting package called MeDoc ({{Interlanguage link|M.E.Doc|uk}}), developed by Intellect Service.<ref name=BBCUkb80 /> MeDoc was widely used among tax accountants in Ukraine,<ref name="nytimes 29jun">{{cite web | url = https://www.nytimes.com/2017/06/28/world/europe/ukraine-ransomware-cyberbomb-accountants-russia.html | title = Ukraine Cyberattack Was Meant to Paralyze, not Profit, Evidence Shows | first = Andrew | last = Kramer | date = 28 June 2017 | access-date = 29 June 2017 | work = {{wipe|The New York Times}} | archive-date = 29 June 2017 | archive-url = https://web.archive.org/web/20170629022218/https://www.nytimes.com/2017/06/28/world/europe/ukraine-ransomware-cyberbomb-accountants-russia.html | url-status = live }}</ref> and the software was the main option for accounting for other Ukrainian businesses, according to Mikko Hyppönen, a security expert at [[Company:F-Secure|F-Secure]].<ref name=BBCUkb80 /> MeDoc had about 400,000 customers across Ukraine, representing about 90% of the country's domestic firms,<ref name=BBCUca26717/> and prior to the attack was installed on an estimated 1 million computers in Ukraine.<ref name="ap jul05">{{cite news | url = https://www.washingtonpost.com/business/technology/ukraine-we-prevented-second-cyberattack/2017/07/05/3cb65202-615f-11e7-80a2-8c226031ac3f_story.html | title = Ukraine says it foiled 2nd cyberattack after police raid | first= Raphael | last= Satter| newspaper = {{wipe|The Washington Post}} | date = 5 July 2017 | access-date = 5 July 2017 | agency = Associated Press }}{{dead link|date=June 2021|bot=medic}}{{cbignore|bot=medic}}</ref>

MeDoc provides periodic updates to its program through an update server. On the day of the attack, 27 June 2017, an update for MeDoc was pushed out by the update server, following which the ransomware attack began to appear. British malware expert Marcus Hutchins claimed "It looks like the software's automatic update system was compromised and used to download and run malware rather than updates for the software."<ref name=BBCUkb80 /> The company that produces MeDoc claimed they had no intentional involvement in the ransomware attack, as their computer offices were also affected, and they are cooperating with law enforcement to track down the origin.<ref name="nytimes 29jun" /><ref>{{Cite web | url = https://www.nytimes.com/2017/06/27/technology/global-ransomware-hack-what-we-know-and-dont-know.html | title = Global Ransomware Attack: What We Know and Don't Know | first = Sheera | last = Frenkel | date = 27 June 2017 | access-date = 28 June 2017 | work = {{wipe|The New York Times}} | archive-date = 27 June 2017 | archive-url = https://web.archive.org/web/20170627204742/https://www.nytimes.com/2017/06/27/technology/global-ransomware-hack-what-we-know-and-dont-know.html | url-status = live }}</ref> A similar attack via MeDoc software was carried out on 18 May 2017 with the ransomware XData. Hundreds of accounting departments were affected in Ukraine.<ref>{{cite news|url=https://ain.ua/2017/05/24/vse-pro-xdata-poka|title=Все, что известно про вирус-вымогатель XData: кто под угрозой и что делать|last=Красномовец|first=Павел|date=24 May 2017|work=AIN.UA|language=ru|access-date=29 June 2017|archive-date=28 June 2017|archive-url=https://web.archive.org/web/20170628183707/https://ain.ua/2017/05/24/vse-pro-xdata-poka|url-status=live}}</ref>

The cyberattack was based on a modified version of the [[Engineering:Petya (malware)|Petya]] [[Ransomware|ransomware]]. Like the [[Engineering:WannaCry ransomware attack|WannaCry ransomware attack]] in May 2017, Petya uses the [[Engineering:EternalBlue|EternalBlue]] exploit previously discovered in older versions of the [[Software:Microsoft Windows|Microsoft Windows]] operating system. When Petya is executed, it encrypts the Master File Table of the hard drive and forces the computer to restart. It then displays a message to the user, telling them their files are now encrypted and to send US$300 in [[Software:Bitcoin|bitcoin]] to one of three wallets to receive instructions to decrypt their computer. At the same time, the software exploits the [[Server Message Block]] protocol in Windows to infect local computers on the same network and any remote computers it can find. Additionally, the NotPetya software was found to use a variant of [[Mimikatz]], a proof-of-concept exploit found in 2011 that demonstrated that user passwords had been retained in computer memory within Windows, exploiting these passwords to help spread across networks.<ref name="wired sandworm"/>

The EternalBlue exploit had been previously identified, and Microsoft issued patches in March 2017 to shut down the exploit for [[Software:Windows Vista|Windows Vista]], [[Software:Windows 7|Windows 7]], [[Software:Windows 8.1|Windows 8.1]], [[Software:Windows 10|Windows 10]], [[Software:Windows Server 2008|Windows Server 2008]], [[Software:Windows Server 2012|Windows Server 2012]], and [[Software:Windows Server 2016|Windows Server 2016]]. However, the WannaCry attack progressed through many computer systems that still used older Windows operating systems or older versions of the newer ones, which still had the exploit, or that users had not taken the steps to download the patches. Microsoft issued new patches for [[Software:Windows XP|Windows XP]], [[Software:Windows Server 2003|Windows Server 2003]] and [[Software:Windows 8|Windows 8]] the day after the WannaCry attack. Security expert Lesley Carhart stated that "Every method of exploitation that the attack used to spread was preventable by well-documented means."<ref name="bbc future">{{cite web | url = http://www.bbc.com/future/story/20170704-the-day-a-mysterious-cyber-attack-crippled-ukraine | title = The day a mysterious cyber-attack crippled Ukraine | first = Christian | last = Borys | date = 4 July 2017 | access-date = 8 July 2017 | work = BBC | archive-date = 7 July 2017 | archive-url = https://web.archive.org/web/20170707211738/http://www.bbc.com/future/story/20170704-the-day-a-mysterious-cyber-attack-crippled-ukraine | url-status = live }}</ref>

Security experts found that the version of Petya used in the Ukraine cyberattacks had been modified, and consequently was renamed NotPetya or Nyetna to distinguish it from the original malware. NotPetya encrypted all of the files on the infected computers, not just the Master File Table, and in some cases the computer's files were completely wiped or rewritten in a manner that could not be undone through decryption.<ref name="reuters jun29">{{cite web | url = https://www.reuters.com/article/us-cyber-attack-ukraine-idUSKBN19K1WI | title = Global cyber attack likely cover for malware installation in Ukraine: police official | first = Pavel | last = Polityuk | date = 29 June 2017 | access-date = 29 June 2017 | work = {{wipe|Reuters}} | archive-date = 29 June 2017 | archive-url = https://web.archive.org/web/20170629141642/https://www.reuters.com/article/us-cyber-attack-ukraine-idUSKBN19K1WI | url-status = live }}</ref><ref>{{cite web | url = https://money.cnn.com/2017/06/30/technology/ransomware-cyber-attack-computer/index.html | title = Experts: Global cyberattack looks more like 'sabotage' than ransomware | first = Alanna | last = Petroff | date = 30 June 2017 | access-date = 30 June 2017 | work = CNN | archive-date = 1 July 2017 | archive-url = https://web.archive.org/web/20170701001503/http://money.cnn.com/2017/06/30/technology/ransomware-cyber-attack-computer/index.html | url-status = live }}</ref> Some security experts saw that the software could intercept passwords and perform administrator-level actions that could further ruin computer files. They also noted that the software could identify specific computer systems and bypass infection of those systems, suggesting the attack was more surgical in its goal.<ref name="bbc future"/> Unlike the WannaCry software, a "[[Engineering:Kill switch|kill switch]]" was never found in NotPetya, which could have been used to immediately stop its spread.<ref>{{cite web | url = https://money.cnn.com/2017/06/28/technology/cyberattack-malware-europol/index.html?iid=EL | title = Europol: There's no 'kill switch' for malware attack | first = Alanna | last = Petroff | date = 28 June 2017 | access-date = 30 June 2017 | work = CNN | archive-date = 19 October 2017 | archive-url = https://web.archive.org/web/20171019080655/http://money.cnn.com/2017/06/28/technology/cyberattack-malware-europol/index.html?iid=EL | url-status = live }}</ref> According to Nicholas Weaver of the [[Organization:University of California|University of California]] the hackers had previously compromised MeDoc "made it into a remote-control Trojan, and then they were willing to burn this asset to launch this attack."<ref name=BBCUca26717/>

== Attack ==
{{See|Petya (malware)}}
During the attack the radiation monitoring system at Ukraine's Chernobyl Nuclear Power Plant went offline.<ref>{{Cite news|url=https://www.independent.co.uk/news/world/europe/chernobyl-ukraine-petya-cyber-attack-hack-nuclear-power-plant-danger-latest-a7810941.html|title=Chernobyl's radiation monitoring system has been hit by the worldwide cyber attack|last=Griffin|first=Andrew|date=27 June 2017|work=The Independent|access-date=27 June 2017|language=en-GB|archive-date=18 August 2019|archive-url=https://web.archive.org/web/20190818234657/https://www.independent.co.uk/news/world/europe/chernobyl-ukraine-petya-cyber-attack-hack-nuclear-power-plant-danger-latest-a7810941.html|url-status=live}}</ref> Several Ukrainian ministries, banks, metro systems and state-owned enterprises (Boryspil International Airport, Ukrtelecom, Ukrposhta, State Savings Bank of Ukraine, Ukrainian Railways) were affected.<ref>{{Cite news|url=https://www.independent.co.uk/news/world/europe/ukraine-cyber-attack-hackers-national-bank-state-power-company-airport-rozenko-pavlo-cabinet-a7810471.html|title=Ukraine cyber attack: Chaos as national bank, state power provider and airport hit by hackers|last=Dearden|first=Lizzie|date=27 June 2017|work=The Independent|access-date=27 June 2017|language=en-GB|archive-date=30 August 2019|archive-url=https://web.archive.org/web/20190830043507/https://www.independent.co.uk/news/world/europe/ukraine-cyber-attack-hackers-national-bank-state-power-company-airport-rozenko-pavlo-cabinet-a7810471.html|url-status=live}}</ref> In the infected computers, important computer files were overwritten and thus permanently damaged, despite the malware's displayed message to the user indicating that all files could be recovered "safely and easily" by meeting the attackers' demands and making the requested payment in [[Software:Bitcoin|Bitcoin]] currency.<ref>{{Cite news|url=https://www.bbc.com/news/technology-40442578|title=Cyber-attack was about data and not money, say experts|date=29 June 2017|work=BBC News|access-date=29 June 2017|language=en-GB|archive-date=29 June 2017|archive-url=https://web.archive.org/web/20170629125348/http://www.bbc.com/news/technology-40442578|url-status=live}}<br />{{Cite web|url=https://arstechnica.com/security/2017/06/petya-outbreak-was-a-chaos-sowing-wiper-not-profit-seeking-ransomware/|title=Tuesday's massive ransomware outbreak was, in fact, something much worse|work=Ars Technica|date=28 June 2017|access-date=28 June 2017|language=en-us|archive-date=17 July 2017|archive-url=https://web.archive.org/web/20170717073820/https://arstechnica.com/security/2017/06/petya-outbreak-was-a-chaos-sowing-wiper-not-profit-seeking-ransomware/|url-status=live}}</ref>

The attack has been seen to be more likely aimed at crippling the Ukrainian state rather than for monetary reasons.<ref name="nytimes 29jun" /> The attack came on the eve of the Ukrainian public holiday, Constitution Day (celebrating the anniversary of the approval by the Verkhovna Rada (Ukraine's parliament) of the Constitution of Ukraine on 28 June 1996).<ref>[http://www.ukrweekly.com/old/archive/1996/529606.shtml 1996: THE YEAR IN REVIEW] {{Webarchive|url=https://web.archive.org/web/20160303190426/http://www.ukrweekly.com/old/archive/1996/529606.shtml |date=3 March 2016 }}, The Ukrainian Weekly (29 December 1996)</ref><ref name=BBCUkrainRb>{{Cite news|url=https://www.bbc.com/news/technology-40427907|title='Vaccine' created for huge cyber-attack|last=Lee|first=David|date=28 June 2017|work=BBC News|access-date=28 June 2017|language=en-GB|archive-date=28 June 2017|archive-url=https://web.archive.org/web/20170628072258/http://www.bbc.com/news/technology-40427907|url-status=live}}</ref><ref name=NYTfUb>{{Cite web | url = https://mobile.nytimes.com/2017/06/27/technology/ransomware-hackers.html | title = Cyberattack Hits Ukraine Then Spreads Internationally | date = 27 June 2017 | access-date = 28 June 2017 | work = {{wipe|The New York Times}} | archive-date = 27 June 2017 | archive-url = https://web.archive.org/web/20170627220429/https://mobile.nytimes.com/2017/06/27/technology/ransomware-hackers.html | url-status = live }}</ref> Most government offices would be empty, allowing the cyberattack to spread without interference.<ref name="nytimes 29jun" /> In addition, some security experts saw the ransomware engage in wiping the affected hard drives rather than encrypting them, which would be a further disaster for companies affected by this.<ref name="nytimes 29jun" />

A short time before the cyberattack began, it was reported that a senior intelligence officer and head of a special forces detachment unit of the Ukrainian Chief Directorate of Intelligence, colonel Maksym Shapoval, was assassinated in [[Place:Kyiv|Kyiv]] by a car bomb.<ref>{{cite news|last1=Luhn|first1=Alec|title=Ukrainian military intelligence officer killed by car bomb in Kiev|url=https://www.theguardian.com/world/2017/jun/27/ukraine-colonel-maksim-shapoval-killed-car-bomb-kiev|access-date=28 June 2017|work=The Guardian|archive-date=13 April 2019|archive-url=https://web.archive.org/web/20190413181212/https://www.theguardian.com/world/2017/jun/27/ukraine-colonel-maksim-shapoval-killed-car-bomb-kiev|url-status=live}}</ref> Former government adviser in [[Place:Georgia (country)|Georgia]] and Moldova Molly K. McKew believed this assassination was related to the cyberattack.<ref>{{cite news|last1=McKew|first1=Molly|title=A killing in Kiev shows how the West continues to fail Ukraine|url=https://www.washingtonpost.com/news/democracy-post/wp/2017/06/27/a-killing-in-kiev-shows-how-the-west-continues-to-fail-ukraine/|date=27 June 2017|access-date=28 June 2017|newspaper=The Washington Post|archive-date=27 June 2017|archive-url=https://web.archive.org/web/20170627195113/https://www.washingtonpost.com/news/democracy-post/wp/2017/06/27/a-killing-in-kiev-shows-how-the-west-continues-to-fail-ukraine/|url-status=live}}</ref>

On 28 June 2017 the Ukrainian government stated that the attack was halted, "The situation is under complete control of the cyber security specialists, they are now working to restore the lost data."<ref name=Ukrif28617>[https://www.ukrinform.net/rubric-politics/2255698-cyber-attack-on-ukrainian-government-and-corporate-networks-halted.html Cyber attack on Ukrainian government and corporate networks halted] {{Webarchive|url=https://web.archive.org/web/20200511160938/https://www.ukrinform.net/rubric-polytics/2255698-cyber-attack-on-ukrainian-government-and-corporate-networks-halted.html |date=11 May 2020 }}, Ukrinform (28 June 2017)</ref>

Following the initial 27 June attack, security experts found that the code that had infected the M.E.Doc update had a [[Backdoor (computing)|backdoor]] that could potentially be used to launch another cyberattack. On seeing signs of another cyberattack, the Ukrainian police raided the offices of MeDoc on 4 July 2017 and seized their servers. MeDoc's CEO stated that they were not aware there had been a backdoor installed on their servers, again refuted their involvement in the attack, and were working to help authorities identify the source.<ref name="ap jul05"/><ref>{{Cite web | url = https://www.reuters.com/article/us-cyber-attack-ukraine-backdoor-idUSKBN19Q14P | title = Ukraine scrambles to contain new cyber threat after NotPetya attack | first = Jack | last = Stubbs | date = 5 July 2017 | access-date = 5 July 2017 | work = {{wipe|Reuters}} | archive-date = 7 July 2017 | archive-url = https://web.archive.org/web/20170707004025/http://www.reuters.com/article/us-cyber-attack-ukraine-backdoor-idUSKBN19Q14P | url-status = live }}</ref> Security company [[Company:ESET|ESET]] found that the backdoor had been installed on MeDoc's updater service as early as 15 May 2017, while experts from [[Company:Cisco Systems|Cisco Systems]]' Talos group found evidence of the backdoor as early as April 2017; either situation points to the cyberattack as a "thoroughly well-planned and well-executed operation".<ref name="arstech 5jul">{{cite web | url = https://arstechnica.com/security/2017/07/heavily-armed-police-raid-company-that-seeded-last-weeks-notpetya-outbreak/ | title = Backdoor built in to widely used tax app seeded last week's NotPetya outbreak | first = Dan | last = Goodin | date = 5 July 2017 | access-date = 5 July 2017 | work = [[Ars Technica]] | archive-date = 8 July 2017 | archive-url = https://web.archive.org/web/20170708200235/https://arstechnica.com/security/2017/07/heavily-armed-police-raid-company-that-seeded-last-weeks-notpetya-outbreak/ | url-status = live }}</ref> Ukrainian officials have stated that Intellect Service will "face criminal responsibility", as they were previously warned about lax security on their servers by anti-virus firms prior to these events but did not take steps to prevent it.<ref>{{cite web | url = https://apnews.com/8b02768224de485eb4e7b33ae55b02f2 | title = Official: firm at center of cyberattack knew of problems | first = Raphael | last = Satter | date = 3 July 2017 | access-date = 7 July 2017 | work = Associated Press | archive-date = 5 July 2017 | archive-url = https://web.archive.org/web/20170705011813/https://apnews.com/8b02768224de485eb4e7b33ae55b02f2 | url-status = live }}</ref> Talos warned that due to the large size of the MeDoc update that contained the NotPetya malware (1.5 gigabytes), there may have been other backdoors that they have yet to find, and another attack could be possible.<ref name="arstech 5jul"/>

== Attribution ==
On 30 June, the Security Service of Ukraine (SBU) reported it had seized the equipment that had been used to launch the cyberattack, claiming it to have belonged to Russian agents responsible for launching the attack.<ref name= "reuters seized">{{Cite web | url = https://www.nytimes.com/reuters/2017/06/30/business/30reuters-cyber-attack-ukraine-sbu.html | title = Ukraine Says Seized Equipment Used by Russia to Launch Malware Attacks | work = The NY Times | agency = {{wipe|Reuters}} | date = 30 June 2017 | access-date = 30 June 2017 | archive-date = 30 June 2017 | archive-url = https://web.archive.org/web/20170630134707/https://www.nytimes.com/reuters/2017/06/30/business/30reuters-cyber-attack-ukraine-sbu.html | url-status = live }}</ref> On 1 July 2017 the SBU claimed that available data showed that the same perpetrators who in Ukraine in December 2016 attacked the financial system, transport and energy facilities of Ukraine (using TeleBots and BlackEnergy)<ref>{{Cite web|url=https://attack.mitre.org/wiki/Software/S0089|title=Software: BlackEnergy, Black Energy – ATT&CK|website=attack.mitre.org|language=en|access-date=4 July 2017|archive-date=19 October 2017|archive-url=https://web.archive.org/web/20171019080412/https://attack.mitre.org/wiki/Software/S0089|url-status=live}}</ref> were the same hacking groups who attacked Ukraine on 27 June 2017. "This testifies to the involvement of the special services of Russian Federation in this attack," it concluded.<ref name="SBU 1 July 2017">{{Cite web | url = http://mobile.reuters.com/article/idUSKBN19M39P | title = Ukraine points finger at Russian security services in recent cyber attack | publisher = {{wipe|Reuters}} | date = 1 July 2017 | access-date = 1 July 2017 | archive-date = 1 July 2017 | archive-url = https://web.archive.org/web/20170701215006/http://mobile.reuters.com/article/idUSKBN19M39P | url-status = live }}</ref><ref>{{Cite web | url = https://www.rferl.org/a/cyberattack-ukraine-blames-russia/28589606.html | title = Ukraine Security Service Blames Russia For Recent Cyberattack | work = Radio Free Europe | date = 1 July 2017 | access-date = 1 July 2017 | archive-date = 1 July 2017 | archive-url = https://web.archive.org/web/20170701132332/https://www.rferl.org/a/cyberattack-ukraine-blames-russia/28589606.html | url-status = live }}</ref> (A December 2016 cyber attack on a Ukrainian state energy computer caused a power cut in the northern part of the capital, Kyiv).<ref name="SBU 1 July 2017" /> Russia–Ukraine relations are at a frozen state since Russia's 2014 annexation of Crimea followed by a Russian government-backed separatist insurgency in eastern Ukraine in which more than 10,000 people had died by late June 2017.<ref name= "SBU 1 July 2017" /> (Russia has repeatedly denied sending troops or military equipment to eastern Ukraine).<ref name="SBU 1 July 2017" /> Ukraine claims that hacking Ukrainian state institutions is part of what they describe as a "hybrid war" by Russia on Ukraine.<ref name= "SBU 1 July 2017" />

On 30 June 2017, cyber security firm [[Company:ESET|ESET]] claimed that the Telebots group (which they claimed had links to BlackEnergy) was behind the attack: "Prior to the outbreak, the Telebots group targeted mainly the financial sector. The latest outbreak was directed against businesses in Ukraine, but they apparently underestimated the malware's spreading capabilities. That's why the malware went out of control."<ref name= "SBU 1 July 2017" /> ESET had earlier reported that BlackEnergy had been targeting Ukrainian cyber infrastructure since 2014.<ref>‘[https://www.scmagazine.com/russian-blackenergy-malware-strikes-at-ukrainian-media-and-energy-firms/article/527815/ "Russian" BlackEnergy malware strikes at Ukrainian media and energy firms] {{Webarchive|url=https://web.archive.org/web/20170315155110/https://www.scmagazine.com/russian-blackenergy-malware-strikes-at-ukrainian-media-and-energy-firms/article/527815/ |date=15 March 2017 }}’, ''SC Magazine'' (4 January 2016)</ref> In December 2016, ESET had concluded that TeleBots had evolved from the BlackEnergy hackers and that TeleBots had been using cyberattacks to sabotage the Ukrainian financial sector during the second half of 2016.<ref>‘[https://www.scmagazine.com/blackenergy-back-telebots-launch-malicious-toolset-reminiscent-of-earlier-attacks/article/579319/ Telebots cybergang toolset reminiscent of BlackEnergy] {{Webarchive|url=https://web.archive.org/web/20171019083932/https://www.scmagazine.com/blackenergy-back-telebots-launch-malicious-toolset-reminiscent-of-earlier-attacks/article/579319/ |date=19 October 2017 }}’, ''SC Magazine'' (15 December 2016)</ref>

Around the time of 4 July raid on MeDoc, the $10,000 in bitcoin already collected in the listed wallets for NotPetya had been collected, and experts believed it was used to buy space on the anonymous [[Software:Tor (anonymity network)|Tor]] network. One message posted there purportedly from the NotPetya authors demanded 100,000 bitcoin (about $2.6 million) to halt the attack and decrypt all affected files.<ref name="ap jul05"/> On 5 July 2017, a second message purportedly from the NotPetya authors was posted in a [[Software:Tor (anonymity network)|Tor]] website, demanding those that wish to decrypt their files send 100 bitcoin (approximately $250,000). The message was signed with the same [[Public-key cryptography|private key]] used by the original Petya ransomware, suggesting the same group was responsible for both.<ref>{{cite web | url = https://www.theverge.com/2017/7/5/15922216/petya-notpetya-ransomware-authors-bitcoin-demand-decrypt | title = Petya ransomware authors demand $250,000 in first public statement since the attack | first = Russell | last = Brandom | date = 5 July 2017 | access-date = 5 July 2017 | work = [[The Verge]] | archive-date = 6 July 2017 | archive-url = https://web.archive.org/web/20170706001021/https://www.theverge.com/2017/7/5/15922216/petya-notpetya-ransomware-authors-bitcoin-demand-decrypt | url-status = live }}</ref>

According to reports cited in January 2018  the United States Central Intelligence Agency claimed Russia was behind the cyberattack, with Russia's Main Intelligence Directorate (GRU) having designed NotPetya.<ref>{{cite news | url = https://www.washingtonpost.com/world/national-security/russian-military-was-behind-notpetya-cyberattack-in-ukraine-cia-concludes/2018/01/12/048d8506-f7ca-11e7-b34a-b85626af34ef_story.html | title = Russian military was behind 'NotPetya' cyberattack in Ukraine, CIA concludes | first = Ellen | last = Nakashima | date = January 12, 2018 | access-date = February 15, 2018 | newspaper = {{wipe|The Washington Post}} | archive-date = 13 January 2018 | archive-url = https://web.archive.org/web/20180113094658/https://www.washingtonpost.com/world/national-security/russian-military-was-behind-notpetya-cyberattack-in-ukraine-cia-concludes/2018/01/12/048d8506-f7ca-11e7-b34a-b85626af34ef_story.html | url-status = live }}</ref> Similarly, the United Kingdom Ministry of Defence accused Russia in February 2018 of launching the cyberattack, that by attacking systems in the Ukraine, the cyberattack would spread and affect major systems in the United Kingdom and elsewhere. Russia had denied its involvement, pointing out that Russian systems were also impacted by the attack.<ref>{{cite web | url = https://www.theguardian.com/technology/2018/feb/15/uk-blames-russia-notpetya-cyber-attack-ukraine | title = UK blames Russia for NotPetya cyber-attack last year | first = Sarah | last = Marsh | date = February 15, 2018 | access-date = February 15, 2018 | work = {{wipe|The Guardian}} | archive-date = 15 February 2018 | archive-url = https://web.archive.org/web/20180215161557/https://www.theguardian.com/technology/2018/feb/15/uk-blames-russia-notpetya-cyber-attack-ukraine | url-status = live }}</ref>

''Wired'' technology writer Andy Greenberg, in reviewing the history of the cyberattacks, said that the attacks came from a Russian military hacker group called "Sandworm". Greenberg asserted that Sandworm was behind the 2016 blackouts in Kyiv, among other events. The group had been focusing on hacking into Ukraine's financial sector, and sometime in early 2017, had been able to gain access to M.E. Doc's update servers, so that it could be used maliciously to send out the cyberattack in June 2017.<ref name="wired sandworm">{{cite magazine |url=https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/ |title=The Untold Story of NotPetya, the Most Devastating Cyberattack in History |first=Andy |last=Greenberg |date=23 August 2018 |access-date=23 August 2018 |magazine=Wired |archive-date=22 August 2018 |archive-url=https://web.archive.org/web/20180822200418/https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/ |url-status=live }}</ref>

== Affected companies ==
Companies affected include [[Company:Antonov|Antonov]], Kyivstar, [[Company:Vodafone Ukraine|Vodafone Ukraine]], lifecell, TV channels STB, ICTV and ATR, Kyiv Metro, UkrGasVydobuvannya (UGV), gas stations WOG, DTEK, EpiCentre K, Kyiv International Airport (Zhuliany), Prominvestbank, Ukrsotsbank, KredoBank, Oshchadbank and others,<ref name=Ukrif28617 /> with over 1,500 legal entities and individuals having contacted the National Police of Ukraine to indicate that they had been victimized by 27 June 2017 cyberattack.<ref>‘[http://www.pravda.com.ua/news/2017/06/29/7148210 Virus Petya has hurt more than 1,5 thousand legal entities and individuals] {{Webarchive|url=https://web.archive.org/web/20170702100717/http://www.pravda.com.ua/news/2017/06/29/7148210/ |date=2 July 2017 }}’, ''Ukrayinska Pravda'' (29 June 2017) {{in lang|uk}}.</ref> Oshchadbank was again fully functional on 3 July 2017.<ref>‘[http://pda.pravda.com.ua/news/id_7148435 "Oschadbank" resume the work of all departments on July 3] {{Webarchive|url=https://web.archive.org/web/20171019075908/http://pda.pravda.com.ua/news/id_7148435 |date=19 October 2017 }}’, ''Ukrayinska Pravda'' (1 July 2017) {{in lang|uk}}.</ref> Ukraine's electricity company's computers also went offline due to the attack; but the company continued to fully operate without using computers.<ref name=BBCUca26717/>

While more than 80% of affected companies were from Ukraine,{{update inline|date=July 2017}} the ransomware also spread to several companies in other geolocations, due to those businesses having offices in Ukraine and networking around the globe. Non-Ukrainian companies reporting incidents related to the attack include food processor Mondelez International,<ref>{{cite news|last1=Voß|first1=Oliver|title=Milka-Fabrik steht seit einer Woche still|url=http://www.tagesspiegel.de/wirtschaft/wegen-erpressersoftware-petya-milka-fabrik-steht-seit-einer-woche-still/20013388.html|access-date=5 July 2017|work=Tagesspiegel|date=3 July 2017|language=de|archive-date=5 July 2017|archive-url=https://web.archive.org/web/20170705111247/http://www.tagesspiegel.de/wirtschaft/wegen-erpressersoftware-petya-milka-fabrik-steht-seit-einer-woche-still/20013388.html|url-status=live}}</ref> the APM Terminals subsidiary of international shipping company A.P. Moller-Maersk, the [[Company:FedEx|FedEx]] shipping subsidiary TNT Express (in August 2017 its deliveries were still disrupted due to the attack),<ref>[https://www.bbc.com/news/technology-40861982 Customers 'furious' with TNT after cyber-attack meltdown] {{Webarchive|url=https://web.archive.org/web/20180601063930/http://www.bbc.com/news/technology-40861982 |date=1 June 2018 }}, BBC News (9 August 2017)</ref> Chinese shipping company COFCO Group, French construction materials company Saint Gobain,<ref>{{cite web | url = https://www.reuters.com/article/us-cyber-attack-idUSKBN19I1TD | title = New computer virus spreads from Ukraine to disrupt world business | first1 = Eric | last1 = Auchard | first2 = Jack | last2 = Stubbs | first3 = Alessandra | last3 = Prentice | date = 29 June 2017 | access-date = 30 June 2017 | publisher = {{wipe|Reuters}} | archive-date = 28 June 2017 | archive-url = https://web.archive.org/web/20170628220240/http://www.reuters.com/article/us-cyber-attack-idUSKBN19I1TD | url-status = live }}</ref> advertising agency [[Company:WPP plc|WPP plc]],<ref>{{cite news|last1=Perlroth|first1=Nicole|last2=Scott|first2=Mark|last3=Frenkel|first3=Sheera|title=Cyberattack Hits Ukraine Then Spreads Internationally|url=https://www.nytimes.com/2017/06/27/technology/ransomware-hackers.html|access-date=6 July 2017|work=The New York Times|date=27 June 2017|archive-date=13 April 2018|archive-url=https://web.archive.org/web/20180413005050/https://mobile.nytimes.com/2017/06/27/technology/ransomware-hackers.html|url-status=live}}</ref> Heritage Valley Health System of Pittsburgh,<ref>{{cite news|last1=Henley|first1=Jon|last2=Solon|first2=Olivia|title='Petya' ransomware attack strikes companies across Europe and US|url=https://www.theguardian.com/world/2017/jun/27/petya-ransomware-attack-strikes-companies-across-europe|access-date=6 July 2017|work=The Guardian|date=27 June 2017|archive-date=1 May 2021|archive-url=https://web.archive.org/web/20210501230809/https://www.theguardian.com/world/2017/jun/27/petya-ransomware-attack-strikes-companies-across-europe|url-status=live}}</ref> law firm DLA Piper,<ref>{{cite news|last1=Petroff|first1=Alanna|last2=Larson|first2=Selena|title=Another big malware attack ripples across the world|url=https://money.cnn.com/2017/06/27/technology/hacking-petya-europe-ukraine-wpp-rosneft/index.html|access-date=6 July 2017|publisher=CNN|date=28 June 2017|archive-date=5 July 2017|archive-url=https://web.archive.org/web/20170705012152/http://money.cnn.com/2017/06/27/technology/hacking-petya-europe-ukraine-wpp-rosneft/index.html|url-status=live}}</ref> pharmaceutical company Merck & Co.,<ref>{{Cite web|url=https://nypost.com/2017/06/27/europe-cyberattack-also-breaches-merck-headquarters-in-us/|title=Europe cyberattack also breaches Merck headquarters in US|last=Massarella|first=Linda|date=27 June 2017|website=New York Post|access-date=5 July 2017|archive-date=5 July 2017|archive-url=https://web.archive.org/web/20170705153437/http://nypost.com/2017/06/27/europe-cyberattack-also-breaches-merck-headquarters-in-us/|url-status=live}}</ref> consumer goods maker Reckitt Benckiser, and software provider [[Company:Nuance Communications|Nuance Communications]].<ref name="nytimes 6jul">{{cite web | url = https://www.nytimes.com/2017/07/06/technology/search-for-clues-global-cyberattacks.html | title = Lasting Damage and a Search for Clues in Cyberattack | first = Nicole | last = Perlroth | date = 6 July 2017 | access-date = 7 July 2017 | work = {{wipe|The New York Times}} | archive-date = 7 July 2017 | archive-url = https://web.archive.org/web/20170707025531/https://www.nytimes.com/2017/07/06/technology/search-for-clues-global-cyberattacks.html | url-status = live }}</ref> A Ukrainian police officer believes that the ransomware attack was designed to go global so as to distract from the directed cyberattack on Ukraine.<ref>{{cite web | url = https://www.reuters.com/article/us-cyber-attack-ukraine-idUSKBN19K1WI | title = Global cyber attack likely cover for malware installation in Ukraine: police official | first1 = Pavel | last1 = Polityuk | first2 = Eric | last2 = Auchard | date = 29 June 2017 | access-date = 30 June 2017 | publisher = {{wipe|Reuters}} | place = Kiev, Frankfurt | archive-date = 29 June 2017 | archive-url = https://web.archive.org/web/20170629233140/https://www.reuters.com/article/us-cyber-attack-ukraine-idUSKBN19K1WI | url-status = live }}</ref>

The cost of the cyberattack had yet to be determined, as, after a week of its initial attack, companies were still working to mitigate the damage. Reckitt Benckiser lowered its sales estimates by 2% (about $130 million) for the second quarter primarily due to the attack that affected its global supply chain.<ref name="nytimes 6jul"/><ref>{{cite news|last1=Geller|first1=Martinne|last2=Sandle|first2=Paul|title=Reckitt Benckiser trims sales forecasts after cyber attack|url=http://uk.reuters.com/article/us-reckitt-benc-grp-outlook-idUKKBN19R0GQ|access-date=6 July 2017|work=Reuters|date=6 July 2017|archive-date=6 July 2017|archive-url=https://web.archive.org/web/20170706120444/http://uk.reuters.com/article/us-reckitt-benc-grp-outlook-idUKKBN19R0GQ|url-status=live}}</ref> Tom Bossert, the Homeland Security adviser to the President of the United States, stated that the total damage was over {{USD|10 billion}}.<ref name="wired sandworm"/> Among estimated damages to specific companies included over {{USD|870 million}} to Merck, {{USD|400 million}} to FedEx, {{USD|384 million}} to Saint-Gobain, and {{USD|300 million}} to Maersk.<ref name="wired sandworm"/>

== Reaction ==
Secretary of the National Security and Defence Council of Ukraine Oleksandr Turchynov claimed there were signs of Russian involvement in the 27 June cyberattack, although he did not give any direct evidence.<ref>[https://www.rferl.org/a/ukraine-petya-ransomware-cyberattack-ground-zero/28583931.html Ukraine Is 'Ground Zero' For Hackers In Global Cyberattacks] {{Webarchive|url=https://web.archive.org/web/20170701175829/https://www.rferl.org/a/ukraine-petya-ransomware-cyberattack-ground-zero/28583931.html |date=1 July 2017 }}, Radio Free Europe (28 June 2017 )</ref> Russian officials have denied any involvement, calling Ukraine's claims "unfounded blanket accusations".<ref name="reuters seized" /> NATO Secretary-General Jens Stoltenberg vowed on 28 June 2017 that NATO would continue its support for Ukraine to strengthen its cyber defence.<ref>[https://www.ukrinform.net/rubric-defense/2255739-stoltenberg-nato-to-increase-aid-to-ukraine-in-field-of-cyber-defense.html Stoltenberg: NATO to increase aid to Ukraine in field of cyber defense] {{Webarchive|url=https://web.archive.org/web/20171102152753/https://www.ukrinform.net/rubric-defense/2255739-stoltenberg-nato-to-increase-aid-to-ukraine-in-field-of-cyber-defense.html |date=2 November 2017 }}, Ukrinform (28 June 2017)</ref> The White House Press Secretary released a statement on 15 February 2018 attributing the attack to the Russian military, calling it "the most destructive and costly cyberattack in history."<ref>{{Cite web|url=https://trumpwhitehouse.archives.gov/briefings-statements/statement-press-secretary-25/|title=Statement from the Press Secretary|language=en-US|via=National Archives|work=whitehouse.gov|access-date=2019-10-11|archive-date=3 February 2021|archive-url=https://web.archive.org/web/20210203094101/https://trumpwhitehouse.archives.gov/briefings-statements/statement-press-secretary-25/|url-status=live}}</ref>

== See also ==
* December 2015 Ukraine power grid cyberattack
* [[Russian–Ukrainian cyberwarfare]]
* Vulkan files leak

== References ==
{{reflist|30em}}

== External links ==
* {{cite magazine
 | url = https://www.wired.com/story/russian-hackers-attack-ukraine/
 | title = How An Entire Nation Became Russia's Test Lab for Cyberwar
 | first = Andy | last = Greenberg
 | magazine = Wired
 | date = 20 June 2017}}

{{Hacking in the 2010s|collapsed}}

{{DEFAULTSORT:Cyberattacks on Ukraine}}
[[Category:Cyberattacks|Ukraine]]

{{Sourceattribution|2017 Ukraine ransomware attacks}}