Petya starts with Ukraine and then goes global

A coordinated Petya ransomware outbreak on June 27 leveraged a compromised update of Ukrainian accounting software (MeDoc) to infect roughly 80 organizations—primarily in Ukraine—and spread using exploits (CVE-2017-0199, EternalBlue/MS17-010) plus legitimate tools (PsExec, WMI); the malware encrypts files, overwrites MBR/MFT, displays ransom demands, and impacted banks, state enterprises, telecoms and infrastructure. The report includes malware analysis, a kill-switch description, compilation timestamps, victim lists, and detailed mitigation recommendations (patching, credential hygiene, backups, SMBv1 disablement).