National Cyber Security Centre
Russian military ‘almost certainly’ responsible for destructive 2017 cyber attack
An assessment by the National Cyber Security Centre has found that the Russian military was almost certainly responsible for the ‘NotPetya’ cyber attack of June 2017.
The UK Government has made the judgement that the Russian government was responsible for the attack, which particularly affected Ukraine’s financial, energy and government institutions but its indiscriminate design caused it to spread further, affecting other European and Russian business.
The destructive attack masqueraded as ransomware, but its purpose was principally to disrupt. Several indicators seen by the NCSC demonstrated a high level of planning, research and technical capability.
The decision to publicly attribute this incident reiterates the position of the UK and its allies that malicious cyber activity will not be tolerated.
Foreign Office Minister of State with responsibility for Cyber, Lord (Tariq) Ahmad of Wimbledon, said:
“The UK Government judges that the Russian Government, specifically the Russian military, was responsible for the destructive NotPetya cyber-attack of June 2017.
“The attack showed a continued disregard for Ukrainian sovereignty. Its reckless release disrupted organisations across Europe costing hundreds of millions of pounds.
“The Kremlin has positioned Russia in direct opposition to the West: it doesn’t have to be that way. We call upon Russia to be the responsible member of the international community it claims to be rather then secretly trying to undermine it.
“The United Kingdom is identifying, pursuing and responding to malicious cyber activity regardless of where it originates, imposing costs on those who would seek to do us harm.
“We are committed to strengthening coordinated international efforts to uphold a free, open, peaceful and secure cyberspace.”
The NotPetya attack saw a malicious data encryption tool inserted into a legitimate a piece of software used by most of Ukraine’s financial and government institutions.
Once an organisation’s machine was infected, the highly crafted tool was designed to spread rapidly, in some cases overriding the Master Boot Record (MBR) on infected computers and displaying a ransom note asking for payment in Bitcoins. The malware spread via trusted networks, rather than widely over the internet. Therefore, it effectively bypassed the processes put in place to prevent ransomware attacks.
The ransom note instructed victims to make payments to a single Bitcoin wallet with confirmation that they had paid. However, flaws in the payment process quickly became apparent as the ransom note did not display a ‘personal identification ID’ which would enable the attacker to know whose data to decrypt and the payment collection infrastructure was quickly taken down by the attacker’s email provider.
The malware was not designed to be decrypted. This meant that there was no means for victims to recover data once it had been encrypted. Therefore, it is more accurate to describe this attack as destructive than as ransomware.
NotPetya used the EternalBlue and EternalRomance exploits, which the Shadowbrokers group released in early 2017. Microsoft issued a patch for both exploits, so all the victim machines were ones that had not applied these patches.
Latest News from
National Cyber Security Centre
Schoolgirls across the UK show their cyber skills12/02/2020 16:15:00
Hundreds demonstrated their cyber security know-how during the co-ordinated series of competitions across the UK.
Development days open for CyberFirst Girls12/02/2020 10:43:00
Girls that entered the 2019 and 2020 CyberFirst Girls Competitions are now eligible to attend free Development Days across the UK.
CyberFirst Girls Competition – regional finals this Saturday07/02/2020 15:43:00
Across 18 UK venues, schoolgirls will be taking part in the Girls Competition semi-finals this weekend.
Launch of major survey on diversity in the UK cyber sector03/02/2020 09:15:00
A survey has been launched to help improve diversity in the cyber security industry.
Alert: Actors exploiting Citrix products vulnerability29/01/2020 17:08:00
An NCSC alert detailing the investigation into the exploitation of a critical vulnerability in Citrix products.
New plans to safeguard country’s telecoms network and pave way for fast, reliable and secure connectivity28/01/2020 16:15:00
NEW restrictions should be placed on the use of high risk vendors in the UK’s 5G and gigabit-capable networks, the government has announced at the conclusion of its Telecoms Supply Chain Review.
Government to strengthen security of internet-connected products28/01/2020 11:22:00
New legislation to improve security standards of internet-connected household devices.
NCSC nurtures cyber stars of the future22/01/2020 11:15:00
CyberFirst Trailblazers and Adventurers event saw schoolchildren from across London at the NCSC.