Petya

Overview

Petya is one of the most historically destructive malware architectures ever deployed. Originally developed in early 2016 as a commercial ransomware strain by a developer operating under the handle 'Janus Cybercrime Solutions', Petya deviated from traditional userland ransomware by targeting low-level operating system storage structures: it overwrote the Master Boot Record (MBR) and encrypted the Master File Table (MFT) of NTFS volumes, preventing Windows from booting. In June 2017, the malware was repurposed into NotPetya (also tracked as Nyetya or ExPetr), a catastrophic pseudo-ransomware wiper deployed by Russian Military Intelligence (GRU Unit 74455, Sandworm Team). NotPetya was initially seeded through a compromised software update of M.E.Doc, the dominant tax accounting software in Ukraine. Once inside enterprise networks, NotPetya rapidly wormed across subnets by exploiting the EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0145) SMB vulnerabilities, while simultaneously dumping LSASS credentials using Mimikatz and executing remotely via PsExec and WMI. The attack caused an estimated $10 billion in damage worldwide, paralyzing global logistics (Maersk), healthcare (Merck), and multinational infrastructure. In October 2020, the U.S. Department of Justice unsealed a landmark indictment charging six Russian GRU officers for the attack.

Known aliases

Threat reports may refer to this family under multiple names:

• Petya
• NotPetya
• Nyetya
• GoldenEye
• Petrwrap
• ExPetr

Threat Actor Attribution

Attribution is probabilistic, not a science. Each link below states its confidence level and the evidence behind it.

• Russian GRU Unit 74455 (Sandworm Team / TeleBots) High confidence
  Basis: While early 2016 Petya was commercial cybercrime ('Janus'), the June 2017 NotPetya campaign was attributed directly to Russian Military Intelligence (GRU Unit 74455 / Sandworm Team). Formal federal indictments were unsealed by the U.S. Department of Justice in October 2020 charging six GRU officers with deploying the destructive wiper worldwide. [source]

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Known Derivatives & Downstream Variants: Petya Original · Mischa · Goldeneye · Notpetya

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2017-0144 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2017-0145 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).

Command & Control (C2) and Network Profile

How this family talks to its operators. C2 traffic can often identify a family even when its code and configuration are hard to analyse. Ports and patterns are historical and change between campaigns, so use them as hunting leads rather than block-only rules.

Network detection ideas

• Alert on sudden high-volume internal lateral SMBv1 traffic on TCP port 445 matching EternalBlue exploitation signatures
• Monitor for rundll32.exe or perfc.dat executing with #1 export ordinal across multiple internal systems
• Inspect for unauthorized overwriting of physical drive sector 0 (\\.\PhysicalDrive0 / Master Boot Record)

Sources: US DOJ Sandworm / NotPetya Indictment Announcement, CISA Alert TA17-181A

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745
• 71b6a493388e7d0b40c83ce903bc6b04265d93e0cae99055fa72b3391a540746

Delivery vectors

• Supply-chain compromise of Ukrainian accounting software M.E.Doc update server
• Lateral movement across internal subnets via EternalBlue and harvested credentials via PsExec/WMI

Persistence mechanisms

• Overwrites Master Boot Record (MBR) on \\.\PhysicalDrive0 and schedules hard reboot via shutdown.exe /r /f
• Forced blue-screen crash to initiate malicious chkdsk screen encryption routine

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_PETYA_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Petya"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "petya" ascii wide nocase
        $s2 = "petya" ascii wide nocase
        $s3 = "notpetya" ascii wide nocase
        $s4 = "nyetya" ascii wide nocase
        $s5 = "goldeneye" ascii wide nocase
        $s6 = "petrwrap" ascii wide nocase
        $s7 = "expetr" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Petya (Ransomware) Execution & Triage
id: 7fe1db2f-8718-59b9-a5c7-d539fad180fb
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Petya malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/petya
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1047
- attack.t1561_002
- attack.t1569_002
- attack.t1490
- attack.t1210
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_PETYA_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Petya tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "petya" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly sever network connections to infected endpoints to halt the lateral spread via SMB (EternalBlue).
2. If a machine suddenly reboots and displays a fake CHKDSK screen, immediately power it off. This interrupts the MFT encryption process, potentially saving the data.
3. Deploy global firewall rules to block lateral SMB traffic (TCP port 445) across internal subnets.
4. Do not pay the ransom; in NotPetya variants, the decryption key mechanism is intentionally broken and recovery is impossible.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow the fake CHKDSK process to complete; powering off the machine during this phase is the only way to stop the encryption.
2. Avoid relying solely on patching to stop the spread; NotPetya also leverages stolen credentials (via Mimikatz) to propagate to fully patched systems.

References & External Analysis

• CISA Advisory: CISA Alert TA17-181A (Petya/NotPetya Ransomware)
• Search "petya" on VirusTotal (External Analysis)
• Search "petya" on Any.Run (Sandbox Sandbox)
• Search "petya" on MalwareBazaar (Malware Samples)

North American Authority Advisory (CISA / NIST)

The Cybersecurity and Infrastructure Security Agency (CISA) has published an official US federal advisory on this family, which can be mapped to NIST Cybersecurity Framework (CSF) incident response controls: CISA Alert TA17-181A (Petya/NotPetya Ransomware) ↗

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Bruhorn
• Bhosta
• Meno
• Cossta
• Fwwy
• Vopackage
• Dunco
• Rapid

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/petya.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.