The starting point I emphasized in my NotPetya review is a trusted enterprise distribution path: the update path for Ukrainian accounting software M.E.Doc. It then moved laterally and disrupted organizations well beyond its initial target geography.
Why the word ransomware is misleading
The incident displayed a payment demand, but U.S. Department of Justice reporting described the destructive purpose behind the campaign. It's more accurate to analyze NotPetya as destructive malware masquerading as ransomware than to assume paying would have restored data.
The failure chain includes a compromised software-distribution trust path, execution inside trusted business environments, and movement into other reachable systems. For many affected organizations, the software vendor wasn't an optional internet site: it was a required part of tax and accounting workflows.
Where trust was inherited
A signed-in employee installing an update is not equivalent to the update's payload being trustworthy. Application delivery, privileged execution, service-account permissions and network connectivity create separate boundaries.
A supply-chain review for this class of case should cover:
- Which vendors can deliver executable code into managed systems?
- Can update provenance, build signatures and release integrity be independently checked?
- Do update processes have broader privileges than the application requires?
- Can compromise of one vendor-connected workstation reach domain-wide administrative pathways?
- Are immutable recovery materials available outside that trust domain?
None of those questions implies that one product setting would have stopped the historical incident. They are architecture decisions informed by the failure.
Source and attribution
The 2020 U.S. Justice Department indictment attributed the destructive campaign to alleged Russian GRU officers. An indictment is an official allegation; it is not itself a forensic reproduction of every infection path.
Sources
Scope: Public reporting synthesis. No M.E.Doc image, incident logs or NotPetya binary examined here.