Skip to main content
Darkfield

Operator dossier

NotPetya is a ransomware operator currently active on public leak sites. Darkfield has indexed 1 public victims claimed by this operator between July 29, 2026 and January 1, 2017.

Recent disclosures by NotPetya

All 1 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for NotPetya →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

NotPetya

1 victims indexed · first seen 2 hours ago · last activity 10 years ago

1
Victims indexed
#323 of 370 tracked operators
<1m
Active period
Jul 2026 → Jan 2017
—
Countries hit

At a glance

Status
active
First seen
2 hours ago
Last activity
10 years ago

Recent victims

Loading…

Source

Updated 10 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time NotPetya posts a victim.

Add NotPetya to your watchlist — Pro pings you within 5 minutes of any new NotPetya leak-site post, Telegram callout, or affiliate-rebrand inference.