A cargo port at night, lock screens glowing green

Film · June 27, 2017 · 8 min

NotPetya: the most expensive cyberattack in history was not asking for a ransom. It was breaking things

MedellínSoftware · Medellín, Colombia

Russia against Ukraine, June 27, 2017. Maersk, Merck, FedEx, Mondelez. Ten billion dollars. A wiper dressed as ransomware. The rest of the world as collateral.

medellinsoftware.com/story/notpetya-ataque-mas-destructivo-historia/

Damage

~USD 10B

Origin

GRU · Sandworm

Bait

M.E.Doc, Ukraine

Type

Wiper

NotPetya pretended to be ransomware. It asked for bitcoin. There was no key. The target was Ukraine — the accounting software M.E.Doc, installed across almost every company in the country — and the collateral ate the planet.

Maersk: 49,000 laptops, 3,500 servers, silent ports. Merck: vaccine production stopped. TNT Express, Mondelez, hospitals. The White House attributed the blow to the Russian military. Sandworm. The GRU.

The lesson is not technical. It is civilizational: a weapon designed for a neighbor does not respect customs. A tax update in Kyiv shut cranes in New Jersey.

The chain is EternalBlue, Maersk minute by minute, and a disguised wiper: the scenario that scares a board more than any other.

Source · White House / NCSC

The desk

The file is public. The briefing is requested.

AI and deep military intelligence. Medellín.