Petya Malware Family

Petya is a malware family first discovered in 2016 that targeted Microsoft Windows systems. The original Petya strain encrypted key disk structures (such as the master file table), blocked normal boot, and demanded a Bitcoin ransom.

Early Petya campaigns were distributed through phishing emails that delivered malicious attachments. Later variants evolved in delivery and behavior.

In 2017, the NotPetya outbreak spread through a compromised update mechanism for Ukrainian accounting software (MeDoc) and then moved across networks using the EternalBlue exploit and credential-based lateral movement tools.

Although NotPetya presented itself like ransomware, it was widely analyzed as a destructive wiper because recovery was generally not possible, even with payment. The 2017 incident caused major operational disruption across organizations in Ukraine and around the world.

The name “Petya” is associated with the malware family linked to Janus Cybercrime Solutions, with references to the James Bond film GoldenEye in its branding and naming.

Source

This post is a summary/adaptation based on:

• Petya (malware family) - Wikipedia