Cyber Incident Victim: BNP Paribas Real Estate
Date:
Jun 2017
Location:
Ukraine
Summary
A ransomware attack utilizing the NotPetya malware disrupted operations across multiple multinational corporations and critical infrastructure, primarily affecting Ukraine and Russia. The attack, resembling the earlier WannaCry incident, encrypted systems and demanded $300 in cryptocurrency for decryption. Among the impacted entities were energy firms, shipping companies, pharmaceutical manufacturers, advertising agencies, and BNP Paribas Real Estate. The malware caused operational disruptions including halted container processing at major ports and temporary loss of system access. Security researchers confirmed over 2,000 affected systems and identified NotPetya as a distinct malware variant rather than an iteration of prior Petya ransomware.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
The NotPetya ransomware attack emerged on or around June 27, 2017, initially targeting Ukraine and Russia before spreading internationally. The malware blocked access to infected systems, demanding a ransom payment of $300 in cryptocurrency to restore functionality. Ukrainian authorities claimed to have halted the attack by June 28, stating cybersecurity specialists were working to recover lost data while maintaining full control of the situation. The attack methodology resembled the WannaCry ransomware that caused global disruptions in May 2017, though NotPetya was later assessed as a distinct malware variant rather than an iteration of the earlier Petya ransomware. Critical infrastructure impacts included radiation monitoring systems at Ukraine's Chernobyl nuclear site and operations at Kiev's international airport.
Multinational corporations across multiple sectors experienced significant disruptions, with confirmed impacts on Russian oil company Rosneft, Danish shipping firm Maersk, pharmaceutical manufacturer Merck, French building materials company Saint-Gobain, British advertising group WPP, and German consumer goods producer Beiersdorf. BNP Paribas publicly confirmed its real estate subsidiary was compromised during the incident. In France, retail chain Auchan and national railway operator SNCF reported infections, prompting the Paris prosecutor's office to initiate a formal investigation. Secondary effects included operational delays at India's Port of Bombay due to Maersk's compromised systems. Security firm Kaspersky Labs documented over 2,000 affected systems during the outbreak, with concentrated impact in Ukraine and Russia. The incident highlighted vulnerabilities in global supply chains and critical infrastructure networks through its rapid propagation across interconnected corporate systems.