NotPetya

The attack

According to the UK government, the primary targets were the Ukrainian financial, energy and government sectors. Because of its indiscriminate design, the attack spread further, affecting other European and Russian businesses.¹

The Council of the EU stated that NotPetya (also known as EternalPetya) made data inaccessible in a number of companies in the Union.²

Attribution

On 15 February 2018 the UK Foreign Office Minister for Cyber Security, Lord Ahmad of Wimbledon, announced that in the government's assessment the Russian government, specifically the Russian military, was responsible. The UK's National Cyber Security Centre assessed that the Russian military was “almost certainly” responsible.¹

On 30 July 2020 the Council of the EU imposed sanctions over cyber attacks (Decision 2020/1127). The list included the Main Centre for Special Technologies (GTsST) of the Russian military intelligence service, the GRU, held responsible for NotPetya and for an attack on the Ukrainian power grid that resulted in parts of it being switched off in winter. According to the Council, the GTsST plays an active role in the activities of the Sandworm group.²

The same decision

Decision 2020/1127 also covered the WannaCry attack, linked to the APT38/Lazarus Group, and the attempted attack on the Organisation for the Prohibition of Chemical Weapons (OPCW): in April 2018 four Russian military intelligence officers attempted to gain unauthorised access to the OPCW's Wi-Fi network in The Hague.²