NotPetya (also tracked as ExPetr and PetrWrap) is destructive malware that spread in June 2017 and imitated the ransom flow of the earlier Petya family. It overwrites the master boot record and encrypts the NTFS master file table, then shows a ransom note demanding Bitcoin and an installation ID. The installation ID shown to the victim is generated with the Windows CryptGenRandom function, so it is random data rather than an encoding of the key material. In the earlier Petya, Mischa and GoldenEye builds that same field carried the information needed to reconstruct a key. Here it carries none, and the operators held nothing that corresponded to it. Analysis concluded the campaign was built to destroy data rather than to collect ransom, so it is a wiper wearing a ransomware interface. Recovery is from backups and from offline copies made before the intrusion.
Decryptor: No public decryptor was found. Checked 2026-10-27.
Sources: Kaspersky
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161