NotPetya: How a Russian malware created the world's worst cyberattack ever

Imagine you wake up one day for work and realise that the IT hub in the office is acting fishy. All your colleagues, donning sharp suits, carrying compact laptops and tablets in one hand, a flask of coffee on the other, head to their desks for the day's operations to begin, only to find out that their files, both official and personal, are being "encrypted". A daunting idea, isn't it? And what if these files in your C drive are mysteriously being repaired or, maybe in a more surreal way, you are being ordered to pay a sum of $300 worth of bitcoin to decrypt the files -- all this is not just a wicked idea, but this is what happened at the time when the most devastating cyberattack took place in today's history.

Andy Greenberg, a senior writer with WIRED and author of his forthcoming Doubleday publication, Sandworm, chronicled the birth of the biggest cyberattack, that began, at least, as an assault on one nation by another. In an excerpt from his book, Greenberg says,"For the past four and a half years, Ukraine has been locked in a grinding, undeclared war with Russia that has killed more than 10,000 Ukrainians and displaced millions more. 

Cyberattack hits Ukraine then spreads internationally

Computer systems from Ukraine to the United States were struck on Tuesday in an international cyberattack that was similar to a recent assault that crippled tens of thousands of machines worldwide.

In Kiev, the capital of Ukraine, A.T.M.s stopped working. About 80 miles away, workers were forced to manually monitor radiation at the old Chernobyl nuclear plant when their computers failed. And tech managers at companies around the world — from Maersk, the Danish shipping conglomerate, to Merck, the drug giant in the United States — were scrambling to respond. Even an Australian factory for the chocolate giant Cadbury was affected.

It was unclear who was behind this cyberattack, and the extent of its impact was still hard to gauge Tuesday. It started as an attack on Ukrainian government and business computer systems — an assault that appeared to have been intended to hit the day before a holiday marking the adoption in 1996 of Ukraine’s first Constitution after its break from the Soviet Union. The attack spread from there, causing collateral damage around the world.

The outbreak was the latest and perhaps the most sophisticated in a series of attacks making use of dozens of hacking tools that were stolen from the National Security Agency and leaked online in April by a group called the Shadow Brokers.

Like the WannaCry attacks in May, the latest global hacking took control of computers and demanded digital ransom from their owners to regain access. The new attack used the same National Security Agency hacking tool, Eternal Blue, that was used in the WannaCry episode, as well as two other methods to promote its spread, according to researchers at the computer security company Symantec.

The National Security Agency has not acknowledged its tools were used in WannaCry or other attacks. But computer security specialists are demanding that the agency help the rest of the world defend against the weapons it created.
READ MORE