NotPetya
MITREOther
Unknown
Unknown
[NotPetya](https://attack.mitre.org/software/S0368) is malware that was used by [Sandworm Team](https://attack.mitre.org/groups/G0034) in a worldwide attack starting on June 27, 2017. While [NotPetya](https://attack.mitre.org/software/S0368) appears as a form of ransomware, its main purpose was to destroy data and disk structures on compromised systems; the attackers never intended to make the encrypted data recoverable. As such, [NotPetya](https://attack.mitre.org/software/S0368) may be more appropriately thought of as a form of wiper malware. [NotPetya](https://attack.mitre.org/software/S0368) contains worm-like features to spread itself across a computer network using the SMBv1 exploits EternalBlue and EternalRomance.(Citation: Talos Nyetya June 2017)(Citation: US-CERT NotPetya 2017)(Citation: ESET Telebots June 2017)(Citation: US District Court Indictment GRU Unit 74455 October 2020)
Associated Techniques (14)
| ID | ATT&CK | Tactics |
|---|---|---|
| T1003.001 | LSASS Memory | - |
| T1021.002 | SMB/Windows Admin Shares | - |
| T1036 | Masquerading | - |
| T1047 | Windows Management Instrumentation | - |
| T1053.005 | Scheduled Task | - |
| T1070.001 | Clear Windows Event Logs | - |
| T1078.003 | Local Accounts | - |
| T1083 | File and Directory Discovery | - |
| T1210 | Exploitation of Remote Services | - |
| T1218.011 | Rundll32 | - |
| T1486 | Data Encrypted for Impact | - |
| T1518.001 | Security Software Discovery | - |
| T1529 | System Shutdown/Reboot | - |
| T1569.002 | Service Execution | - |
Aliases (525)
Used by Actors (1)
Metadata
| ID: | 247 |
| Created: | 13/01/2026 17:48 |
| Updated: | 06/03/2026 16:00 |