Analysis · Retrospective 2017
NotPetya spread through credentials as well as exploits
The NotPetya record connects a poisoned update, stolen credentials and remote administration across recovery boundaries.
CVE-2017-0144
Technical coverage, source documents and official vulnerability records.
FISRO coverage
Read the relevant deployment conditions, remediation steps and limits of the evidence in the linked material.
Analysis · Retrospective 2017
WannaCry exposed a gap in patch verification
WannaCry, MS17-010 and the gap between a patch notice, installed software and a service that can recover.
Sources from this coverage
- Update on Petya malware attacksMicrosoft
- Petya destructive malware variant spreading via credentials and EternalBlueMandiant
- Petya-Like Malware CampaignCERT-EU
- Get-LocalGroupMicrosoft Learn
- WannaCrypt ransomware worm targets out-of-date systemsMicrosoft
- MS17-010: Windows SMB security bulletinMicrosoft
- Investigation: WannaCry cyber attack and the NHSNational Audit Office
- Get-SmbServerConfigurationMicrosoft Learn