On June 27, 2017, a piece of malware distributed through a hijacked software update for a Ukrainian tax-accounting program detonated across the internet, self-propagating through corporate networks worldwide using leaked NSA exploits and stolen credentials. Within Ukraine it hit government ministries, banks, energy utilities, the Kyiv metro, and even the radiation-monitoring systems at Chernobyl. Outside Ukraine, it caused what the White House would later call, in its formal February 2018 attribution statement, "the most destructive and costly cyber-attack in history" — over $10 billion in global damage by U.S. government estimate (The White House, 2018). This card examines that campaign specifically through the experience of one collateral victim: A.P. Møller-Maersk, the world's largest container shipping company, whose entire global IT estate — roughly 150 countries' worth of terminals, vessels, and back-office systems running on a single flat Windows domain — was wiped in minutes because one of its business units happened to run the compromised Ukrainian tax software.
Maersk was never the intended target. The malware, publicly named NotPetya (also tracked as Petya.A, GoldenEye, ExPetr, and Nyetya across vendor reporting), was built and deployed by Russia's military intelligence directorate as an instrument aimed squarely at Ukraine, timed one day before Ukraine's Constitution Day and amid the ongoing conflict following Russia's 2014 annexation of Crimea. Its worm-like propagation mechanism, however, recognized no border and no target list: any organization anywhere in the world with a network-connected machine running the trojanized M.E.Doc update, or with an unpatched or credential-exposed machine on the same flat network as one, was fair game. Maersk's exposure came through Maersk's Ukraine-based freight-forwarding operations; from there, the malware crossed onto Maersk's single global Windows domain and detonated company-wide.
What makes the Maersk case the canonical teaching example of NotPetya — more than Merck, more than FedEx/TNT Express, more than any of the incident's dozens of other major corporate victims — is the combination of the scale of destruction (every domain controller Maersk operated was wiped except one, saved purely by chance), the specificity of the recovery story (a hard drive physically flown out of a small West African office to rebuild the company's Active Directory), and the fact that Maersk's own leadership, notably then-Chairman Jim Hagemann Snabe, spoke publicly and in detail about the incident at forums including the World Economic Forum — producing an unusually well-documented, first-person account of what a full-enterprise wipe actually looks like from inside a Fortune Global 500 company.
Nearly a decade later, Maersk-NotPetya remains foundational reference material for business continuity planning, Active Directory security architecture, cyber insurance underwriting (via the parallel Merck and Mondelez litigation over "war exclusion" clauses triggered by the same campaign), and the broader doctrine of cyber-attack attribution, since the joint February 2018 statement by the U.S. and seven allied governments represented the most coordinated multinational attribution of a cyberattack to a nation-state that had occurred up to that point.
By mid-2017, Sandworm Team — the GRU unit publicly tracked today under a long list of vendor names (ELECTRUM, Telebots, BlackEnergy, Voodoo Bear, Iron Viking, Seashell Blizzard, and, in Mandiant's later consolidated tracking, APT44) — had already conducted two confirmed disruptive attacks on Ukraine's power grid, in December 2015 and December 2016, using the BlackEnergy and Industroyer/CRASHOVERRIDE toolsets to trigger real blackouts (MITRE ATT&CK G0034; DOJ indictment, 2020). NotPetya extended that pattern from physical infrastructure disruption to a broader, IT-centric destructive campaign, timed to detonate on June 27 — the eve of Ukraine's Constitution Day — reinforcing the assessment that the operation was a deliberate act of hybrid warfare against Ukraine rather than a financially motivated ransomware campaign that happened to spread out of control.
The entry vector exploited a specific, structural weakness in Ukraine's software ecosystem: M.E.Doc, produced by the Ukrainian company Intellect Service, was the dominant tax-filing and accounting application used by companies doing business in Ukraine, reportedly present on a substantial share of all computers in the country and used by any foreign company with a Ukrainian subsidiary or filing obligation — Maersk's Ukraine-based freight forwarding unit among them. Forensic analysis after the fact found the attackers had compromised an employee account on M.E.Doc's own update servers and distributed the backdoor through at least three tainted software updates — April 14, May 15, and June 22, 2017 — meaning it sat live in a widely-trusted update channel for roughly ten weeks before the June 27 trigger (the same channel was separately used in May 2017 to distribute an unrelated ransomware family, XData, before being repurposed for NotPetya). M.E.Doc's own server software had not been patched since 2013 — a vendor security posture ESET later described the resulting operation as exploiting "thoroughly" (ESET, TeleBots, 2017; Cisco Talos, 2017).
Maersk's own internal architecture compounded the exposure once the malware crossed onto its network. Like many large, decades-old multinational conglomerates that had grown through acquisition (Maersk's structure spans Maersk Line, APM Terminals, Damco, Svitzer, and other units), the company ran essentially all of its global Windows infrastructure — vessels, terminals, back offices, across roughly 130 countries — on a single, largely flat Active Directory domain, with limited segmentation between business units or geographies. This is precisely the condition NotPetya's propagation mechanism was engineered to exploit: once inside any part of a flat, single-domain network, credential-harvesting and SMB-exploit-driven lateral movement could reach essentially everything.
rundll32.exe "C:\Windows\perfc.dat",#1 on infected hosts, overwrote each machine's Master Boot Record with a custom bootloader and displayed a fake CHKDSK repair screen while it encrypted the Master File Table and, on hosts where it obtained administrator rights, individual files matching a hard-coded extension list — rendering every affected machine completely unusable and demanding a $300 Bitcoin payment to a single hard-coded wallet address, with proof-of-payment instructions to email a fixed address at the German provider Posteo. Security researchers established within hours that the "ransomware" framing was a decoy: the malware generated a random installation ID with no cryptographic relationship to the actual per-victim encryption key, meaning the attackers could not have provided a working decryption key even to a victim who paid — a design choice, not a bug, that confirmed NotPetya's actual purpose was destruction, not extortion (Comae Technologies/Matt Suiche, 2017; Kaspersky, 2017). Posteo suspended the ransom-contact inbox within hours of the outbreak once it recognized its service was being used to facilitate a ransomware campaign, permanently severing the fictitious payment channel. This phase is marked "detected" in the sense that its effects were immediately and unmistakably obvious to every victim the moment it activated — there was no covert dwell time here to miss, only an instantaneous, total loss of the machine.rundll32.exe "perfc.dat",#1 on infected hosts, a technique consistently documented across vendor forensic writeups.perfc.dat, executed via rundll32.exe "C:\Windows\perfc.dat",#1. Overwrites the Master Boot Record with a custom bootloader, encrypts the Master File Table, and on hosts with elevated privileges encrypts individual files by extension. Displays a forged CHKDSK screen during MFT encryption to delay victim recognition. Confirmed non-recoverable by design — the victim installation ID has no cryptographic relationship to the actual encryption key.| Type | Value / Description | Source | Date |
|---|---|---|---|
| FILE | C:\Windows\perfc.dat (primary payload DLL, no file extension executed via rundll32 export #1) | Cisco Talos, ESET | 2017-06-27 |
| EXEC PATTERN | rundll32.exe "C:\Windows\perfc.dat",#1 | Cisco Talos, Microsoft MSTIC | 2017-06-27 |
| EMAIL (extortion contact) | wowsmith123456[at]posteo[.]net — suspended by provider within hours of outbreak | BleepingComputer, Motherboard/Vice | 2017-06-27 |
| BTC WALLET | 1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX8 — single hard-coded address for the entire global campaign | BleepingComputer, Fortune | 2017-06-27/28 |
| CVE | CVE-2017-0144 (EternalBlue) / CVE-2017-0145 (EternalRomance) — patched by MS17-010 | Microsoft, MITRE CVE | 2017-03-14 |
| NOTE | No specific vendor-published file hashes (MD5/SHA) are reproduced in this card. Contemporaneous hash-based IOC packages were published by ESET, Kaspersky, and Microsoft at the time of the outbreak — see References for original vendor advisories rather than a value transcribed here from memory. | ||
Attribution here rests on a substantially stronger evidentiary base than most nation-state cyber incidents reach: a coordinated, multi-government formal statement naming the Russian military specifically; a detailed criminal indictment naming six individual GRU officers with role-specific allegations (Pliskin credited with developing NotPetya components, alongside his and Andrienko's separate work on Olympic Destroyer); Treasury sanctions applied under a named legal authority; and technical continuity between NotPetya's tradecraft and Sandworm's well-documented prior Ukrainian power-grid attacks. No companion threat-actor profile card exists yet in this repository for Sandworm Team / GRU Unit 74455 / APT44 — a gap worth closing given the group's broader operational history extends well beyond this single incident (Ukraine grid attacks 2015–2016, Olympic Destroyer 2018, ongoing Ukraine-conflict operations tracked into the 2020s).
Maersk-NotPetya endures as a teaching case for a reason distinct from most incidents in this repository: it is not primarily a story about a detection failure, but about what happens when detection is irrelevant — when a destructive payload's activation and its impact are the same instant, and every meaningful defensive decision had to have already been made beforehand. That reframing is itself the case's central lesson for defenders: patch management, network segmentation, and offline backup architecture are not merely best practices among many, but the entire available defense against a category of attack where there is no detection window to exploit once the payload fires.
The incident is also the canonical real-world illustration of why domain-controller backup isolation matters specifically, not backups in general — Maersk had backups, and lost them anyway, because they were reachable from the same network the malware was already spreading across. The company's survival hinged on an unrelated, unplanned power outage in a small West African office, a fact identity-security practitioners have cited for years since as the sharpest available argument for offline, immutable backup of directory-services infrastructure in particular.
Beyond its technical lessons, the incident helped establish coordinated multinational attribution as a functioning diplomatic tool: the February 2018 joint statement by nine governments set a template later incidents' attributions would follow, and the subsequent named indictment of individual GRU officers — with specific malware-development roles alleged — pushed nation-state cyber accountability further toward individualized, evidence-based legal action than prior incidents had achieved. Finally, through the parallel Merck and Mondelez litigation the same campaign generated, NotPetya reshaped how the insurance industry drafts and defends war-exclusion clauses against cyber losses — a regulatory and contractual legacy still actively cited in cyber-insurance underwriting discussions today.