NotPetya (2017) and the war exclusion disputes

NotPetya is a large-scale cyberattack launched in June 2017 and publicly attributed by the US, British and Australian governments to Russian military intelligence (GRU). The malware initially spread via a corrupted update to the Ukrainian accounting software M.E.Doc. It then spread through the internal networks of large multinationals by exploiting the EternalBlue vulnerability, the same one used a month earlier by WannaCry. Unlike conventional ransomware, NotPetya was a wiper disguised as ransomware: it irreversibly encrypted the master boot records of machines, with no functional decryption mechanism. It also spread laterally by harvesting credentials from memory with the Mimikatz tool, which allowed near-automatic spread across poorly segmented Windows networks. Total economic losses are estimated at more than 10 billion dollars. They hit companies such as Maersk, Merck, FedEx and Saint-Gobain. For the insurance market, NotPetya exposed the silent cyber problem. It triggered landmark disputes, notably Merck v. its insurers (1.4 billion dollars). Those disputes drove the overhaul of war exclusion clauses and LMA bulletin LMA21-042-PD of November 25, 2021, which published clauses LMA 5564 to 5567. Not to be confused with WannaCry, launched on May 12, 2017 through the same EternalBlue flaw: WannaCry demanded a ransom that could be paid, NotPetya destroyed, and it was the destruction that raised the question of an act of war. Where the word appears: in no clause, but in the court filings it gave rise to, and behind every definition of cyber operation and impacted state drafted since 2021.

• White House, statement of 15 February 2018 attributing NotPetya to the Russian military
• Merck & Co. v. ACE American Insurance Co., New Jersey Appellate Division, 1 May 2023