ALT-38 · Analysis · 23 Oct 2026
NotPetya: the wiper that came through a tax update
A destructive worm disguised as ransomware spread from a Ukrainian accounting program's update server to global companies in hours. The mechanism, the cost, and the attribution.
- 27 Jun 2017The worm spreads within hours from Ukrainian networks to multinationals.
- Aug 2017Maersk estimates its cost at $200–300 million.
- 15 Feb 2018The White House calls it the most destructive and costly cyber-attack in history and attributes it to Russia's military.
- Maersk's own estimate of its cost
- $200–300MMaersk Q2 2017 interim report, via Computer Weekly
How it spread
Inside a network it combined two methods: EternalBlue against unpatched Windows machines, and credentials pulled from memory to log into patched ones. The second meant patching alone was not enough; one administrator's password could open everything.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Update channels are the most trusted path into a network — and therefore a target.
- Credential reuse turns one compromised machine into all of them.
- Organisations that only did business in a country still became collateral damage.
What to do
- Use unique local administrator passwords (LAPS or equivalent) on every machine.
- Segment networks so that one site's compromise cannot reach every other site.
- Keep offline backups — including of domain controllers — and practise rebuilding.
Sources
- White House — Statement from the Press Secretary (15 Feb 2018)
- CISA — Petya ransomware alert (TA17-181A)
- Computer Weekly — NotPetya attack cost up to $300m, says Maersk (Aug 2017)
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-38 — NotPetya: the wiper that came through a tax update. 23 Oct 2026. altumptic.com/research/notpetya-2017