NotPetya destructive malware spreads worldwide
27 Jun 2017 · Worldwide · Official attribution
NotPetya wiper malware was launched on 27 June 2017 through Ukrainian accounting software and spread worldwide. Companies across Europe, the US and elsewhere suffered heavy losses. The map point marks Copenhagen, home of Maersk, one of the most affected firms, and is illustrative only.
Established by. UK Foreign Office attribution to the Russian military (15 Feb 2018), with US and allied statements. EU Council sanctions of 30 July 2020 (Implementing Regulation (EU) 2020/1125) listed GRU's Main Centre for Special Technologies (GTsST, 'Sandworm'). US indictment of six GRU Unit 74455 officers (15 Oct 2020).
Latest. EU cyber sanctions listings remain in force. The US indictment is outstanding, and no defendant is in custody.
Link to the war against Ukraine. The attack started in Ukraine and was aimed mainly at Ukraine before spreading worldwide.
B US Department of Justice – Six Russian GRU officers charged in connection with worldwide deployment of destructive malware ↗
C MIT Technology Review – The UK says Russia was behind the huge NotPetya ransomware attack ↗
Open in the interactive hub → ↑ Beyond Ukraine
Use this record. Quote the figures with the source and date named on this page; in statements, briefings and reporting cite the original body, not this site. The data are open (CC BY 4.0).
Open data (CC BY 4.0) Subscribe to updates Report an error Method & corrections
Sections: Case files · Historical dossiers · Fact-checks · UN on the record · Beyond Ukraine · The world's response · Negotiations track · Sanctions · Research & analysis · Research desk
Languages: English · Français · Español · Русский · العربية · 中文
Page generated 2026-10-23 · CC BY 4.0