NotPetya and the server saved by a power cut

The story

On June 27, 2017, a routine update for an accounting program widely used in Ukraine carried a hidden payload. Attackers had broken into the software maker and slipped their code into the update.

The code, later named NotPetya, spread from computer to computer across company networks, then across the world through companies with offices in Ukraine. It displayed a ransom note, but the encryption could not be reversed. It was built to destroy. The US and UK governments later attributed it to the Russian military.

Among the victims was Maersk, one of the world’s largest shipping companies. Within hours, its computers worldwide were unusable. Ports stopped. Staff went back to pen, paper and personal phones.

The lucky break

To rebuild, Maersk needed a copy of the central system that held every user account and password, the domain controller. Every copy had been wiped, except one. A power outage had knocked a server in its Ghana office offline before the attack spread, so it was never infected. A staff member flew the hard drive out of Ghana, and the company rebuilt its network from it.

The lesson today

• Trusted software can be the way in. Updates from a vendor you rely on are normally safe, which is exactly why attackers target them.
• Recovery depends on a copy the attack cannot reach. Maersk’s survived by accident. A backup kept offline or in a separate cloud account makes it a plan instead of luck.
• Know what you would need first. Account systems, backups and the passwords to restore them are what every recovery starts with.