MCAD Maritime Cyber Attack Database
Year2017 |
MonthJune |
Reference number20170603 |
Impact areaShore |
Incident location |
Incident countryUkraine |
Victim countryUkraine |
Victim identityA.P. Møller Maersk: Pipapav, ICD Dadri, CFS Nhava Sheva |
Victim TypeShipping Company |
MethodMalware |
Attacker countryRussia |
In June 2017, shipping giant A.P. Møller Maersk got hit by a malware attack. During this incident a Wiper Virus (NotPetya) infected servers all across the globe. In total 65 countries have been infected. A vendor software update was the vehicle that carried the devastating NotPetya malware virus into Maersk's IT servers . The cyber attack can be traced to software updates from the Ukrainian accounting program M.E.Doc. Investigators from the security firm Talos travel to Ukraine to assist M.E.Doc in analysing their systems and to find out how the company has penetrated. It gradually appears that hackers become ingeniously managed to gain access for months to the systems of Intellect Service, the parent company of M.E.Doc. This is a software developer of, among other things, the accounting system M.E.Doc, which is frequently used to exchange with the Ukrainian tax authorities. By hiding the malware in the software update process, NotPetya went undetected into the networks of companies that used this software. Updates have been released with a backdoor, a hacker-made change to the M.E.Doc software, which allowed them to distribute NotPetya to customers of this software vendor. The impact was immense. In total there were 17 shipping container terminals affected in Ukraine, Russia, Germany, United States, United Kingdom, France, Denmark and The Netherlands. Maersk suffered $250 – 300 million financial loss and data contamination, delayed container deliveries and traffic jams in and around ports. About 4.000 servers, 45.000 computers and 2.500 applications had to be rebuild by Maersk. In the meantime, paper documents were glued on containers and orders were taken through personal G-mail accounts, WhatsApp and Excel files. The Russian Sandworm Team, also known as Unit74455 was behind this attack and the campaign was to disrupt Computer Systems across Ukraine. A.P. Møller Maersk along with other companies are collateral damage from this attack.
