ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Malware & tools

S0368malware

NotPetya

a.k.a. ExPetr, Diskcoder.C, GoldenEye, Petrwrap, Nyetya

NotPetya is malware that was used by Sandworm Team in a worldwide attack starting on June 27, 2017. While NotPetya appears as a form of ransomware, its main purpose was to destroy data and disk structures on compromised systems; the attackers never intended to make the encrypted data recoverable. As such, NotPetya may be more appropriately thought of as a form of wiper malware. NotPetya contains worm-like features to spread itself across a computer network using the SMBv1 exploits EternalBlue and EternalRomance.

Platforms: Windows

MITRE ATT&CK ↗

Linked entities · 15

usesT1569.002Service Execution usesT1053.005Scheduled Task usesT1021.002SMB/Windows Admin Shares usesT1685.005Clear Windows Event Logs usesT1518.001Security Software Discovery usesT1047Windows Management Instrumentation usesT1083File and Directory Discovery usesT1003.001LSASS Memory usesT1529System Shutdown/Reboot usesT1486Data Encrypted for Impact usesT1036Masquerading usesT1218.011Rundll32 usesT1078.003Local Accounts usesT1210Exploitation of Remote Services uses byG0034Sandworm Team