Darktrace’s perspective on the NotPetya attack

Dave Palmer, Director of Technology | Thursday June 29, 2017

The ‘ransomware’ attack sweeping the globe is yet another demonstration of the decreasing usefulness of the traditional cyber defense approaches. Businesses cannot rely on patching vulnerabilities fast enough, and a NotPetya patch would only protect you against yesterday’s attack but will not be able to stop tomorrow’s.

An interesting difference to last month’s WannaCry attack is that it could spread from victim to new victim directly over the internet. Whilst this one can also spread quickly within organizations, Petya (or NotPetya) has not spread across the internet. The good news is that if you haven’t been affected yet, it is unlikely you will be.

At first glance, this might look like conventional ransomware, but it has emerged that the system for paying the criminals and decrypting data doesn’t work. This means that regardless of whether monetization was the original motive or not, it will feel like sabotage from the victims’ perspective.

Questions regarding whether the attack was a targeted one or not are in this case legitimate, as the initial deployment was via poisoning legitimate accountancy software heavily used in Ukraine and Ukrainian city websites. A majority of businesses affected would have been operating in the Ukraine area, or connected to them via their supply chain.

How many more warnings do we need that relying on stopping attacks seen in the past just isn’t enough? The latest advances in AI mean that autonomous technology can now detect and fight back against any in-progress threats within a company network, buying the security teams time to investigate.

In our tests, Darktrace has confirmed the ability to autonomously respond to NotPetya, neutralizing the threat in seconds. Enterprise Immune System technology works because it doesn’t rely on rules or signatures. It takes defensive action before humans have time to react, and is the only realistic way that security teams will scale to the increased speed and diversity of future attacks.

Blog Archive

Thursday January 10, 2019
Monday December 3, 2018
Thursday November 22, 2018
Thursday October 25, 2018
Thursday October 4, 2018
Monday August 20, 2018
Monday July 16, 2018
Friday June 22, 2018
Wednesday May 9, 2018
Monday April 16, 2018
Wednesday March 7, 2018
Tuesday February 13, 2018
Friday February 2, 2018
Monday January 22, 2018
Friday December 8, 2017
Monday November 27, 2017
Monday October 30, 2017
Wednesday October 25, 2017
Thursday October 12, 2017
Monday October 2, 2017
Monday September 18, 2017
Monday July 31, 2017
Thursday June 29, 2017
Wednesday June 21, 2017
Wednesday May 17, 2017
Monday May 8, 2017
Wednesday April 5, 2017
Monday March 6, 2017
Monday February 13, 2017
Monday January 30, 2017
Monday January 9, 2017
Friday December 16, 2016
Monday December 5, 2016
Friday November 18, 2016
Friday November 4, 2016
Monday October 24, 2016

About the authors

Justin Fier

Justin Fier is the Director for Cyber Intelligence & Analytics at Darktrace, based in Washington D.C. Justin is one of the US’s leading cyber intelligence experts, and his insights have been widely reported in leading media outlets, including Wall Street Journal, CNN, the Washington Post, and VICELAND. With over 10 years of experience in cyber defense, Justin has supported various elements in the US intelligence community, holding mission-critical security roles with Lockheed Martin, Northrop Grumman Mission Systems and Abraxas. Justin is also a highly-skilled technical specialist, and works with Darktrace’s strategic global customers on threat analysis, defensive cyber operations, protecting IoT, and machine learning.

Dave Palmer

Dave Palmer is the Director of Technology at Darktrace, overseeing the mathematics and engineering teams and project strategies. With over ten years of experience at the forefront of government intelligence operations, Palmer has worked across UK intelligence agencies GCHQ & MI5, where he delivered mission-critical infrastructure services, including the replacement and security of entire global networks, the development of operational internet capabilities and the management of critical disaster recovery incidents. He holds a first-class degree in Computer Science and Software Engineering from the University of Birmingham.

Andrew Tsonchev

Andrew advises Darktrace’s strategic Fortune 500 customers on advanced threat detection, machine learning and autonomous response. He has a technical background in threat analysis and research, and holds a first-class degree in physics from Oxford University and a first-class degree in philosophy from King’s College London. He was most recently featured on BBC World, BBC Morning and Al Jazeera to comment on the news regarding the GRU.

Max Heinemeyer

Max is a cyber security expert with over eight years’ experience in the field specializing in network monitoring and offensive security. At Darktrace, Max works with strategic customers to help them investigate and respond to threats as well as overseeing the cyber security analyst team in the Cambridge UK headquarters. Prior to his current role, Max led the Threat and Vulnerability Management department for Hewlett-Packard in Central Europe. He was a member of the German Chaos Computer Club, working as a white hat hacker in penetration testing and red teaming engagements. Max holds a MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.