Expetr

Threat Actor Profile Updated 3 months ago

Download STIX

Preview STIX

ExPetr, also known as PetrWrap, Petya, or NotPetya, is a threat actor that emerged in the cybersecurity landscape on April 15, 2017, with its first ransomware attack infused with EternalBlue. The code used by ExPetr was borrowed from another malicious software called Win32/Diskcoder.Petya ransomware, leading to various names attributed to this threat actor. ExPetr's actions are characterized by their malicious intent, with attacks typically targeted against corporate networks using methods similar to those seen in other high-profile cyber threats. On June 27, 2017, ExPetr launched a significant attack using the EternalBlue exploit. This attack was particularly notable due to its destructive nature. Unlike typical ransomware attacks where data can be recovered upon payment of a ransom, analysis revealed that the threat actors behind ExPetr were technically unable to decrypt the Master File Table (MFT) that was encrypted with the GoldenEye component. This led to the conclusion that ExPetr was not truly ransomware, but rather a "wiper," designed more for destruction than financial gain. Further analysis showed a notable similarity between the code of ExPetr and that of another threat actor, Bad Rabbit. However, unlike ExPetr, evidence suggests that Bad Rabbit was not intended as a wiper. This comparison between the two threat actors' hashing routines adds an additional layer of complexity to understanding the motivations and capabilities of these groups. Despite the similarities, each threat actor presents unique challenges and requires distinct countermeasures.

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.

ID	Votes	Profile Description
Bad Rabbit	1	Bad Rabbit is a notorious malware that emerged in October 2017, primarily targeting corporate networks. It operates as ransomware, encrypting the victim's files and disk while offering a means of decryption for a ransom. The malicious software uses fake Adobe Flash installer advertisements to lure v
petya	1	Petya is a type of malware, specifically ransomware, that infected Windows-based systems primarily through phishing emails. It was notorious for its ability to disrupt operations and hold data hostage for ransom. Petya, along with other types of ransomware like WannaCry, NotPetya, TeslaCrypt, and Da
Goldeneye	1	GoldenEye is a recognized threat actor in the cybersecurity world, known for its malicious activities. It's often considered a variant of Petya and has been referred to as WannaCry's sibling due to similarities in their operations. GoldenEye appears to be an adaptation of another source code on GitH
NotPetya	1	NotPetya is a notorious malware that was unleashed in 2017, primarily targeting Ukraine but eventually impacting systems worldwide. This malicious software, which initially appeared to be ransomware, was later revealed to be data destructive malware, causing widespread disruption rather than seeking
win32/diskcoder.petya	1	None

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Ransomware

Exploit

Malware

Payload

Mft

Wiper

Associated Malware

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
Zebrocy	Unspecified	1	Zebrocy is a well-documented Trojan malware that infiltrates systems to gather specific system information. Once installed, it sends the collected data to its Command and Control (C2) server via an HTTP POST request. The Zebrocy variant also captures a screenshot of the victim's host and transmits i
WannaCry	Unspecified	1	WannaCry is a type of malware, specifically ransomware, that caused significant global disruption in 2017. It exploited Windows SMBv1 Remote Code Execution Vulnerabilities (CVE-2017-0144, CVE-2017-0145, CVE-2017-0143), which allowed it to spread rapidly and infect over 200,000 machines across more t
Mosquito	Unspecified	1	The "Mosquito" malware is a harmful software designed to exploit and damage computer systems or devices. It operates covertly, infiltrating systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, it has the capability to steal personal information, disr

Associated Threat Actors

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
APT28	Unspecified	1	APT28, also known as Fancy Bear, is a threat actor linked to Russia and has been involved in numerous cyber espionage campaigns. The group is notorious for its sophisticated tactics, techniques, and procedures (TTPs). Recently, NATO and the EU formally condemned APT28's activities, acknowledging the
Turla	Unspecified	1	Turla, also known as Pensive Ursa, is a sophisticated threat actor linked to Russia that has been active for many years. The group is known for its advanced cyber-espionage capabilities and has been associated with numerous high-profile breaches. According to the MITRE ATT&CK and MITRE Ingenuity dat

Associated Vulnerabilities

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
Eternalblue	Unspecified	2	EternalBlue is a significant software vulnerability that exists in the design or implementation of certain systems. This flaw has been exploited by various cyber threats, with one notable instance being its use as an enabler for the widespread WannaCry ransomware attack. The exploit allows attackers

Source Document References

Information about the Expetr Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source	CreatedAt	Title
CERT-EU	9 months ago	StripedFly: Perennially flying under the radar
CERT-EU	9 months ago	StripedFly: Perennially flying under the radar – GIXtools
MITRE	a year ago	Bad Rabbit ransomware
MITRE	a year ago	TeleBots are back: Supply‑chain attacks against Ukraine \| WeLiveSecurity
MITRE	a year ago	APT Trends report Q2 2017