EternalPetyaMalware
- diskcoder.c
- expetr
- goldeneye
- nonpetya
- NotPetya
- npetya
- nyetya
- petna
- petrwrap
- Petya
- petya/mischa
- pnyetya
According to proofpoint, Bad Rabbit is a strain of ransomware that first appeared in 2017 and is a suspected variant of Petya. Like other strains of ransomware, Bad Rabbit virus infections lock up victims’ computers, servers, or files preventing them from regaining access until a ransom—usually in Bitcoin—is paid.From MISP Galaxy
Last reported yesterday, by Risky Business News22 reports
ATT&CK techniques
6 of 45 · each with the sentence it comes from- T1053.005Scheduled Task
“According to ESET telemetry, the events unfolded as follows: at 06:59 on July 16th, 2025, a scheduled task named pdfopentask was executed on one machine in the target organization.”
- T1684Social Engineering
“Utilizar ataques de phishing y otras técnicas de social engineering para robar credenciales privilegiadas o introducir ransomware u otro malware a través de un tercero, como una empresa de servicios IT.”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Windows Command Shell”
- T1059.003Windows Command Shell
“T1059.003”
- T1105Ingress Tool Transfer
“T1105”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
22 reports · the newest 20, newest first · the exact sentence from each-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies“The incident is one of the largest cyberattacks to hit the maritime sector since the NotPetya ransomware in 2016.”
-
MythicRatatoskr: el backdoor que utilizó la red Yggdrasil antes de un ataque destructivo de Sandworm“En junio de 2017, Sandworm lanzó el ataque de borrado de datos NotPetya, que utilizó un vector de cadena de suministro mediante el compromiso del software contable ucraniano M.E.Doc.”
-
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration“In June 2017 Sandworm launched the NotPetya data-wiping attack that used a supply-chain vector by compromising the Ukrainian accounting software M.E.Doc.”
-
Securing Your Business: The Vital Role of Cyber Insurance“After the 2017 NotPetya attack (and subsequent lawsuits against insurers), carriers have rewritten their rules for nation-state attacks.”
-
What’s the Average Cost of a Data Breach in 2025?“The most expensive data breach ever was the NotPetya/ExPtr data breach in 2017, which cost $10 billion.”
-
Proteger sistemas industriales desactualizados frente a las ciberamenazas modernas“Además, el análisis de ESET sobre NotPetya documentó cómo un ataque sin un objetivo OT específico puede igualmente devastar a organizaciones que operan tecnología operativa a gran escala, incluidos fabricantes.”
-
Riesgos en la cadena de suministro: por qué los proveedores pueden ser un punto ciego“Diseñado para afectar a la economía ucraniana, el ataque propagó el malware destructivo NotPetya a organizaciones de todo el mundo, causando daños estimados en USD 10 mil millones.”
-
Supply chain dependencies: Have you checked your blind spot?“Intended to target the Ukrainian economy, the attack spread NotPetya wiper malware to organizations worldwide, sowing destruction estimated to cost $10 billion.”
-
DynoWiper update: Technical analysis and attribution“In 2017-06 Sandworm launched the NotPetya data-wiping attack that used a supply-chain vector by compromising the Ukrainian accounting software M.E.Doc.”
-
ESET Threat Report H2 2025“H2 2025 also brought an unpleasant flashback to the Petya/NotPetya ransomware, when ESET researchers uncovered HybridPetya – a new derivate of the infamous malware capable of compromising modern UEFI-based systems.”
-
Stranger Threats Are Coming: Group-IB Cyber Predictions for 2026 and Beyond“Incidents like WannaCry (which exploited a Windows vulnerability and caused a large-scale outbreak in just hours), NotPetya (malware acted as a dual means for ransomware and cyberwarfare), and Mirai (exploited vulnerable IoTs to initiate DDoS attacks) caused billions of dollars i…”
-
Ten Years of Resilience, Innovation & Community-Driven Defense“NotPetya attack (June 2017)”
-
Operation Bleeding Bear“These targeted attacks on Ukraine using destructive malware match a similar pattern observed in the past such as NotPetya.”
-
The Darker Things“Apparently, the authors of BlackMatter, just like the authors of another extortionist Petya five years ago, made mistakes in the implementation of the Salsa20 algorithm.”
-
Silence: Moving into the Darkside“At the time, the National Bank of Ukraine linked the attack with a new wave of NotPetya ransomware outbreak, but these were not pro-government hackers.”
-
Cobalt Renaissance“Petya”
-
NotPetya pulls BadRabbit out of the hat“NotPetya pulls BadRabbit out of the hat”
-
BadRabbit: spread of new cryptolocker“During analysis, it became clear that Bad Rabbit is a modified version of NotPetya, with changes to the encryption algorithm and in parts entirely mirrors that of NotPetya:”
-
MSP Moment“…d as a formidable piece of crimeware, thanks to its new self-propagation techniques (undoubtedly inspired by the success of WannaCry and Petya).”
-
Petya starts with Ukraine and then goes global“Petya starts with Ukraine and then goes global”
Indicators in its reports
named in the reports above- 185.149.120[.]3in 2 reports
- 1dnscontrol[.]comin 2 reports
- www.fontanka[.]ruin 2 reports
- hxxp://argumenti[.]ruin 2 reports
- argumenti[.]ruin 2 reports
- hxxp://argumentiru[.]comin 2 reports
- argumentiru[.]comin 2 reports
- fbbdc39af1139aebba4da004475e8839in 2 reports
- webcheck01[.]netin 2 reports
- webdefense1[.]netin 2 reports
- secure-check[.]hostin 2 reports
- firewebmail[.]comin 2 reports
- secureinbox[.]emailin 2 reports
- secure-dns1[.]netin 2 reports
- hxxps://uztickets[.]comin 2 reports
- uztickets[.]comin 2 reports
- hxxps://egyptanimals[.]com/animals/photoalbumin 2 reports
- egyptanimals[.]comin 2 reports
- adomd[.]netin 2 reports
- hxxp://51.15.204[.]214/in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.