The power cut that saved Maersk, and what NotPetya teaches about Active Directory recovery

On 27 June 2017, A.P. Møller-Mærsk lost almost every computer it owned in a single afternoon. Screens went black in offices around the world. Its terminals stopped loading ships, and trucks queued outside the gates with nowhere to go.

What saved the company wasn't a backup plan. It was luck: one domain controller in Ghana that a local power cut had knocked offline before the attack arrived. We've turned the story into a short film.

Can't see the video? Watch it on YouTube.

What happened

NotPetya arrived through M.E.Doc, an accounting package widely used by companies that do business in Ukraine. Attackers had hijacked its update server, so a routine software update delivered the malware straight into every network that ran it, Maersk's office in Odessa included.

From there it spread on its own. It used EternalBlue, an exploit for a Windows SMB flaw that Microsoft had patched in March 2017 (MS17-010), to reach unpatched machines. It also used a Mimikatz-style technique to pull administrator credentials out of memory and log in to machines that were patched. Then it encrypted them. It looked like ransomware and displayed a ransom note, but there was no working way to get the data back. It was built to destroy.

In February 2018, the UK and US governments both said the Russian military was responsible. The White House called it the most destructive and costly cyber attack in history.

The master list was gone

For Maersk, the worst loss wasn't the PCs. It was Active Directory. Maersk ran around 150 domain controllers, all replicating with each other so that every copy was up to date. That design is meant to make a directory resilient. Against malware that wipes every Windows server it can reach, it meant there was no clean copy anywhere. And without Active Directory, nobody can sign in to anything, so there was nothing to rebuild the rest of the network from.

Except in Ghana. A blackout had taken that office's domain controller offline before NotPetya hit, so it never got infected. The connection from Ghana was far too slow to copy the data across, so the drive was flown out: first to Nigeria, then to Heathrow, where it was taken to the recovery team in Maidenhead.

From that one copy, Maersk rebuilt its network. Chairman Jim Hagemann Snabe later said the company reinstalled 4,000 servers and 45,000 PCs in ten days. In its half-year results, Maersk estimated the attack would cost it between $200 million and $300 million.

What it means for your directory

Maersk got lucky. You can't plan for a power cut in the right place at the right time, but you can plan for what that power cut gave them: a clean copy of the directory that the attack couldn't reach.

Keep a copy of Active Directory the attacker can't touch

Replication isn't a backup. It copies damage just as quickly as it copies good changes. Take regular system state backups of at least one domain controller per domain, and keep them somewhere that domain admin credentials can't delete or encrypt: offline, or in immutable storage. Microsoft's AD forest recovery guide sets out what a full recovery involves.

Practise the rebuild

Maersk's team worked it out under pressure, sleeping in the office. Run a forest recovery into an isolated network at least once a year. You'll find out how long it really takes, which steps nobody has written down, and whether your backups actually restore.

Make stolen credentials less useful

NotPetya didn't need an exploit to reach patched machines. It just reused administrator credentials it found in memory. A few controls limit that:

• Windows LAPS gives every machine a unique local administrator password, so one stolen password doesn't open every machine. See Windows LAPS overview.
• Credential Guard protects credentials in memory from tools like Mimikatz. See Credential Guard overview.
• Tiered admin accounts keep domain admin credentials off ordinary servers and PCs, so a compromised workstation doesn't hand over the whole domain.

Treat trusted update paths as a way in

The malware arrived as a legitimate update from software the business relied on. Know which third-party tools can push code into your network with high privileges, restrict what they can reach, and watch what they do after an update, not just whether the update installed.

Patch the old, boring flaws

EternalBlue had a fix for months before NotPetya used it. Check that MS17-010 is applied everywhere, and turn off SMBv1 wherever it isn't needed.

Where's your Ghana?

If every domain controller you own was wiped tomorrow, where would the clean copy come from, how would you get it to the people rebuilding, and how long would it take? If the honest answer is "we'd hope something was switched off", that's the gap to close.

Sources

• Andy Greenberg, "The Untold Story of NotPetya, the Most Devastating Cyberattack in History", WIRED, 2018
• UK Government, "Foreign Office Minister condemns Russia for NotPetya attacks", 15 February 2018
• The White House, Statement from the Press Secretary, 15 February 2018
• A.P. Møller-Mærsk, Interim Report Q2 2017
• Microsoft, Security Bulletin MS17-010