Lessons Learned from NotPetya
“I remember that morning – laptops were periodically restarting and it didn’t appear to be a cyberattack at the time but very quickly the true impact became apparent,“ said Lewis Woodcock, head of cybersecurity compliance at Moller-Maersk. Maersk is a Danish business combination with activities in the transport and logistics and energy divisions. Maersk is the biggest container ship and flexible vessel administrator on the planet. The organization is situated in Copenhagen, Denmark, with auxiliaries across 130 nations and around 90,000 workers.
At present, the Maersk business methodology is centred around utilizing information examination to build up a worldwide exchange digitization stage that will be progressively effective and make sure about strategies for leading worldwide exchange.
A.P. Moller-Maersk, to give the Danish organization its complete name, fell prey to NotPetya on June 27, 2017, in an attack where Kremlin-supported hackers remain the prime suspects. Hackers spread the malware after holding onto control of the product update mechanism of M.E.Doc, the de facto standard accountancy package for firms working together in Ukraine, as a major aspect of a deliberately arranged activity. The effect was as quick as the recuperation was moderate: Maersk’s system was injured inside seven minutes.
The vast majority of the harm was done inside an hour. It took nine days to reestablish its Active Directory system. “Not sufficient,” said Powell – 24 hours ought to be the target turnaround. Nonetheless, the organization excelled in one key viewpoint: They told everybody “what was going on immediately”, said Powell. A long way from being furious, numerous clients’ first reaction was: “How might we help?” He included that “various huge universal organizations hit with NotPetya were less open, genuine, and straightforward.”
What is Petya and NotPetya?
Petya and NotPetya are two bits of malware that influenced a large number of PCs all over the world (in 2016 and 2017). NotPetya (or “Nyetna” as it has additionally been named) spreads to different systems on the network without the utilization of the Eternalblue / Eternalromance SMBv1 misuses. (Although the code contains the capacity to spread by this exploit, fixing is as yet basic). Both Petya and NotPetya mean to encrypt the hard disk of contaminated PCs, and there are sufficient regular highlights between the two that NotPetya was initially observed as only a minor departure from a topic. In any case, NotPetya has a lot of progressively expected apparatuses to assist it with spreading and tainting PCs.
NotPetya virus
The NotPetya infection cursorily takes after Petya in a few different ways: it encodes the master file table and blazes up a screen mentioning a Bitcoin payoff to re-establish access to the documents. However, there are various significant manners by which it’s unique and considerably more perilous:
NotPetya spreads all alone. The first Petya required the casualty to download it from a spam email, dispatch it, and give it administrator consent. NotPetya abuses a few unique strategies to spread without human intercession. The first infection vector comes to be via a backdoor, not the front door.
NotPetya encrypts everything. The NotPetya malware goes a long way past the first Petya stunt of encrypting the MBR (Master Boot Record), pursuing different documents to truly botch your hard disk.
NotPetya isn’t ransomware. This is in reality the most stunning — and significant — thing about NotPetya. It would seem that ransomware, complete with a screen advising the casualty that they can decode their documents on the off chance that they send Bitcoin to a predefined wallet. NotPetya harms it unrecoverable.
A significant number of the PCs tainted by NotPetya were running more established forms of Windows. Microsoft says that Windows 10 was especially ready to fight off NotPetya attacks, not because most introduce auto-updates to fix the SMB vulnerability, but since improved safety efforts hindered a portion of different ways NotPetya spread from one machine to another machine.
Qatar Cybersecurity Boardroom Accountability: Why QCB and NCSA Now Expect Executive Ownership Â
Key Takeaways: Cybersecurity in Qatar is increasingly becoming an executive governance responsibility, with national cybersecurity initiatives and sector-specific requirements encouraging organizations to establish stronger leadership oversight. QCB and NCSA play important roles in strengthening cybersecurity governance in Qatar, with QCB focusing on financial sector requirements and NCSA supporting national-level cybersecurity coordination and guidance. Executives can’t […]
Data Privacy Consulting for Saudi Enterprises: How to Operationalize PDPL Data Subject Rights in 2026
Key Takeaways: The Saudi data protection law may apply to organizations outside the Kingdom when they process personal data related to individuals in Saudi Arabia, meaning geographic location alone does not automatically exclude an organization from PDPL obligations. PDPL data subject rights span access, correction, deletion, and consent withdrawal, and enterprises are on the hook […]
Third-Party Vendor Security Risk Assessment Under DPDP: A Guide for Indian Enterprises
Key Takeaways: Third-party vendor risk assessment with DPDP practices helps Indian enterprises to verify that external partners handle personal data with adequate safeguards. The Digital Personal Data Protection Act holds data fiduciaries accountable for vendor conduct, which makes due diligence a legal and operational necessity. A structured vendor security questionnaire, covering encryption, access control, and […]
Virtual CISO Services for UAE Free Zone Startups: Affordable Security Leadership for Growing Companies
Key Takeaways: Most startups already hold sensitive data such as customer info, source code, financials, long before they feel big enough to take security seriously, and that’s exactly when the risk starts. A virtual CISO gets you someone who’s done this before, setting up strategy and guiding compliance, without the cost of putting a full-time […]
SOC as a Service for Indian BFSI and FinTech Companies: 24/7 Monitoring for CERT-In Readiness
Key Takeaways: SOC as a Service for BFSI and FinTech India gives banks, NBFCs, insurers and digital lenders continuous security visibility without the cost and hiring effort of building an in-house operations centre. CERT-In directions require regulated entities to report qualifying cyber incidents within six hours of detection, and implementing SOC for BFSI and FinTech […]
SOC as a Service in India: How It Works, Pricing, and Why Businesses Need ItÂ
Key Takeaways: SOC as a Service helps Indian businesses to get 24×7 security monitoring without huge cost and complexity of building a full in-house security operations center. A managed SOC check and analyse beyond basic log monitoring, which combining SIEM, threat intelligence, analyst-led alert triage, incident escalation, reporting, and security response support. SOC as a […]
