NotPetya destructive wiper (NOTPETYA-2017)
Destructive wiper · disclosed 2017-06-27 · region: International · primary attribution: Sandworm Team
Sectors touched: Transportation & Warehousing · Air Transportation · Health Care & Social Assistance · Telecommunications · Food Manufacturing
GRU Unit 74455 (Sandworm) trojanised a Ukrainian tax-software update (M.E.Doc) to seed a destructive wiper masquerading as ransomware. ~$10B in global damages; Merck alone reported $870M loss. Insurance carriers cited "act of war" exclusions — precedent-setting Mondelez and Merck cases followed.
Named victims
- Maersk
- Merck
- FedEx
- Mondelez
- WPP
- Saint-Gobain