So the ransomware that tore through Maersk, Merck, and a chunk of Ukraine's government computers a week and a half ago? Turns out it was never ransomware at all. It just really wanted you to think it was.
Quick recap for anyone who was on vacation: on June 27th a piece of malware everyone's calling NotPetya (because it borrowed code from an older family called Petya, then diverged enough that researchers didn't want to conflate the two) spread through a hijacked update for M.E.Doc, which is basically the TurboTax of Ukraine. Every business there that filed taxes electronically had this software installed, which meant the infection had a ready-made highway straight into thousands of networks the second a poisoned update went out. From there it hopped across internal networks fast, using the same EternalBlue exploit that powered WannaCry back in May, plus some old-fashioned credential theft for machines that were already patched.
The headline damage is well covered by now. Maersk, the shipping company that reportedly handles something like a fifth of global freight, got knocked so hard that terminals from Los Angeles to Mumbai were stuck manually logging containers on paper. Merck lost production time on actual medicine. TNT Express, which is FedEx's European delivery arm, is still limping. Chernobyl's radiation monitoring system had to switch over to doing readings by hand because the automated network went down too. That's the part that stuck with me, honestly — nuclear cleanup sites falling back on clipboards because of a tax software update.
But here's the detail that's been nagging at me since I read Matt Suiche's writeup out of Comae Technologies a few days after the attack, and it's the part I don't think got enough attention outside security circles: this thing was never built to let you pay and get your files back.
Normal ransomware (the boring, functional kind) ties your files to a unique key tied to your machine, so when you cough up the Bitcoin, the attacker can look up your specific ID and hand back a matching decryption key. NotPetya displayed something that looked like that same kind of ID on the ransom screen. Except when researchers dug into it, the "installation ID" wasn't derived from anything. It was just random garbage, generated with no connection to the actual encryption key used on your disk. Even if you were an executive at Maersk sitting there with $300 in Bitcoin ready to send, there was no possible way for whoever built this to hand back a working key, because the ID they'd need to do that literally does not encode that information. The whole ransom note was theater.
And then the one email address the malware told you to contact for a decryption key got shut down by Posteo, the German provider hosting it, within hours of the outbreak starting, because obviously they weren't going to keep hosting an active extortion inbox. So even the theater got cancelled mid-performance.
Add up the targeting (overwhelmingly Ukrainian infrastructure and Ukrainian-linked businesses worldwide, with the collateral damage spreading out from there), the busted payment mechanism, and the fact that the ransom demand itself was almost comically small for the scale of the outbreak, and you get a pretty ugly picture: something built to destroy data and cause disruption, dressed up as a criminal shakedown so nobody would ask the more uncomfortable question about who benefits from Ukrainian businesses losing weeks of records right in the middle of tax season. I'm not going to sit here and name a government, because the researchers being careful about attribution right now are being careful for good reason. But I don't think anyone seriously believes this was some guy trying to make Bitcoin money.
Meanwhile the G20 leaders were literally in Hamburg this week talking about cybersecurity cooperation while this was still an open wound for companies trying to reinstall thousands of machines by hand. The timing wasn't lost on me.
If you run anything critical on a Windows network and you still haven't patched for EternalBlue since WannaCry in May, I genuinely don't know what you're waiting for at this point. Offline backups too — not synced folders, actual disconnected backups. This is the second time in two months a story like this has made the rounds, and I doubt it's the last.