WannaCry, NotPetya, MBR-ONI and Friends: Tales of Wiper Attacks and Active Directory Destruction

Making its debut in 2018, the Ryuk ransomware strand has wreaked havoc on hundreds of businesses and is responsible for one-third of all ransomware attacks that took place in 2020.

Semperis argues that testing backups under ideal conditions creates only an illusion of resilience; real cyber resilience is about staying recoverable when the plan fails and the assumptions behind it collapse.

A holiday parody from Semperis retelling NotPetya—'the Russian Wiper'—as a carol, a playful nod to the wiper's EternalBlue-powered destruction and the value of preparing for the next wiper event.

The finale covers the response: missing OS logs on production EC2 instances led to AMI snapshot forensics that exposed reverse shells, with CloudTrail cross-referencing helping uncover the root cause.

Part two reconstructs a real-world, long-term hybrid attack: social-media phishing against IT and security staff, an unmanaged home device lacking EDR, then lateral movement into the victim's cloud.

RSA 2020 interview with Semperis CEO Mickey Bresman: ransomware crews hijack Active Directory for lateral movement; NotPetya's $10B damage shows why AD cyber-resilience tooling matters.