Cyber Incident Victim: Rosneft
Date:
Jun 2017
Location:
Russia
Summary
A ransomware cyberattack known as Petya or NotPetya targeted multiple global organizations, including a major Russian oil company. The attack encrypted systems and demanded Bitcoin payments, prompting the victim to activate backup controls to prevent operational disruptions to oil production and processing. While the incident caused server compromises and required prompt resolution of specific issues, the company maintained normal operations through contingency measures. Security researchers identified the malware as a novel variant propagating via exploits like EternalBlue, affecting corporate networks primarily in Russia and Ukraine. The attack led to widespread system shutdowns across other impacted entities, including shipping and energy firms, though critical infrastructure remained functional through emergency protocols.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On June 27, 2017, Russian oil company Rosneft experienced a large-scale cyberattack as part of a global ransomware campaign initially identified as Petya but later classified as NOTPetya by cybersecurity firm Kaspersky Lab. The attack targeted Rosneft's servers, prompting the company to publicly disclose the incident via Twitter while suggesting possible connections to ongoing court proceedings. Rosneft immediately activated contingency measures by switching to a reserve control system, which prevented operational disruptions to oil production and preparation processes. The company contacted law enforcement authorities to investigate the attack and maintained that any technical issues arising from the incident were resolved promptly. By June 28, Rosneft confirmed its production systems remained unaffected and operations continued normally, though it refrained from providing a full assessment of the attack's impact at that stage.
The NOTPetya malware employed in the attack differed from conventional ransomware by targeting low-level disk structures rather than encrypting individual files, effectively denying system access. Kaspersky Lab identified it as a previously unseen ransomware variant propagating through multiple attack vectors, including a modified EternalBlue exploit for lateral movement within corporate networks. Global telemetry data indicated approximately 2,000 affected users, with concentrated impacts in Russia and Ukraine alongside incidents in Poland, Italy, the UK, Germany, France, and the US. While Rosneft contained the incident through redundant control systems, other major organizations including Maersk and Ukrainian government entities reported significant disruptions, with Maersk shutting down IT systems across multiple sites and terminals. The attackers demanded $300 in Bitcoin for decryption keys, though the ransomware's design prioritized disruption over financial gain through its destructive encryption mechanism.