NotPetya: how a leaked NSA exploit became a nation-state weapon
The 2017 attack chain broken down — supply-chain entry via M.E.Doc, Mimikatz credential theft, EternalBlue — and why it's the canonical CTI case study.
Why This Case Study
NotPetya (June 27, 2017) is treated as a canonical case in threat intelligence because it cleanly demonstrates almost every core CTI concept in one incident: a leaked government cyberweapon, a supply chain compromise, credential theft, and lateral movement — attributed to a specific nation-state actor with a clear motive. Understanding it end-to-end is a good foundation for reading any modern APT threat report.
The Attacker: Sandworm
Sandworm is a threat group tied to Russian military intelligence (GRU). It is one of the most consistently active and destructive state-sponsored groups tracked in CTI reporting, with NotPetya as its most infamous operation. Unlike financially motivated ransomware crews, Sandworm’s objective was disruption, not profit — NotPetya was disguised as ransomware but had no functioning decryption mechanism, making it a wiper in practice.
The Tools in the Attack Chain
1. M.E.Doc — The Initial Entry Point (Not an Exploit)
The actual point of entry wasn’t a technical exploit at all. Sandworm compromised the software update server of M.E.Doc, an accounting application mandated for use by businesses operating in Ukraine, and pushed a poisoned update to its own customer base. This is a software supply chain attack — a technique that has since become one of the most important categories in threat intelligence, because it bypasses almost every perimeter defense by abusing trust in legitimate software.
2. Mimikatz — Credential Theft
Once inside a machine via the poisoned update, the malware used Mimikatz to extract plaintext credentials and hashes sitting in the memory of the LSASS process. Mimikatz is not a leaked or stolen tool — it is legitimate, publicly available open-source software (built by Benjamin Delpy as a proof-of-concept exposing weaknesses in how Windows handles credentials in memory). This makes it a dual-use tool: the exact same binary is used by penetration testers and by nation-state attackers.
3. EternalBlue & EternalRomance — Lateral Movement
With valid stolen credentials in hand, the malware used EternalBlue and EternalRomance — exploits targeting a flaw in the SMBv1 protocol (CVE tracked as MS17-010) — to spread automatically across the network. Critically, because it had legitimate stolen credentials, NotPetya could spread even to fully patched machines using those credentials directly, with the exploits acting as an additional, faster propagation path on unpatched ones.
Where these exploits came from: EternalBlue and EternalRomance were built internally by the NSA’s Equation Group/TAO unit as offensive tools. A group calling itself the Shadow Brokers stole them, attempted an unsuccessful auction, and then publicly dumped them on April 14, 2017. Sandworm did not need any special access — they downloaded the same public leak available to anyone. NotPetya launched barely ten weeks after the leak, illustrating how fast a leaked nation-state capability can be weaponized once public.
The Full Attack Chain
- Initial Access — Poisoned M.E.Doc software update (supply chain compromise)
- Credential Access — Mimikatz dumps credentials from memory
- Lateral Movement — EternalBlue/EternalRomance + stolen credentials spread the payload across the network, patched or not
- Impact — Disk-wiping payload disguised as ransomware, no real recovery path
This maps directly onto the MITRE ATT&CK framework’s tactic categories (Initial Access → Credential Access → Lateral Movement → Impact), which is exactly why this incident is used so often as a teaching example.
Shadow Brokers: The Group That Made This Possible
Shadow Brokers is the group that leaked the NSA’s tools, but they are a mystery in their own right — their real identity was never confirmed, with theories ranging from a rogue NSA insider to a Russian intelligence propaganda operation. After the April 2017 dump they went silent and never resurfaced. Their case is a useful lesson in how a single leak of nation-state tooling can cascade into global damage (WannaCry and NotPetya both trace back to the same leak) — and why “the exploit is patched” doesn’t mean “the exploit is gone,” since it lives on in public repositories indefinitely.
Key Concept: N-Day Exploits
NotPetya is a textbook example of an N-day exploit — a publicly known vulnerability (already assigned a CVE, often already patched upstream) that remains effective purely because real-world systems haven’t applied the patch. Most real-world breaches use N-days rather than fresh 0-days, because they’re cheaper to obtain and just as effective against the huge population of unpatched systems that exists at any given time.
Linux Parallels
The same category of attack exists outside Windows:
- SambaCry (CVE-2017-7494) — sometimes called “EternalRed,” the Linux/Samba equivalent of EternalBlue: remote code execution, no auth required.
- Dirty COW (CVE-2016-5195) — a privilege escalation bug that sat in the Linux kernel undiscovered for nine years before being found.
- Shellshock (CVE-2014-6271) — command injection via Bash environment variables, still scanned for today.
This shows the attack pattern (initial access → privilege escalation → credential theft → lateral movement) is OS-agnostic — only the specific tools change.
Defensive Takeaways
| Attack Stage | Defense |
|---|---|
| Supply chain compromise | Vet software update sources; monitor for anomalous update server behavior |
| Credential theft (Mimikatz-style) | Least privilege, credential rotation, EDR monitoring of LSASS access |
| Exploit-based lateral movement | Patch management, disable legacy protocols (SMBv1), network segmentation |
| Overall | Flat, unsegmented networks are why NotPetya spread so violently — internal segmentation limits blast radius |
What This Teaches About CTI as a Discipline
The most important realization from this case study: raw vulnerability counts and CVSS scores don’t tell you what actually matters. Thousands of CVEs are published every year, but a real CTI analyst’s job is correlating this specific bug with this specific group’s known TTPs, exploit availability on forums, and whether it sits in high-value infrastructure. NotPetya wasn’t dangerous because EternalBlue existed — it was dangerous because a specific, motivated actor chained it together with credential theft and a trusted software supply chain at exactly the right moment.
Comments
Discuss via GitHub — requires Discussions enabled on Dev-Lahrani/resume-website. If disabled, this shows a placeholder.