Tuesday’s massive ransomware outbreak was caused by a malicious software update for M.E.Doc, a popular accounting software used by Ukrainian companies, according to a Bleeping Computer report.
According to sources, such as Cisco Talos, ESET, MalwareHunter, Kaspersky Lab, Ukrainian Police, and others, an unknown attacker compromised the M.E.Doc update servers, and pushed a malicious software update to customers.
When the update reached M.E.Doc’s clients, the tainted software packaged delivered the Petya ransomware — also referenced online as NotPetya, or Petna, says the report.
According to security researcher MalwareHunter, this is not the first time M.E.Doc has carried a malicious software update that delivered ransomware.
Back in May, the company’s servers were also compromised and suspected of carrying the XData ransomware, which caused quite a lot of havoc in the Ukraine at the time it was first spotted. M.E.Doc denied its software update servers were involved in that attack as well.
M.E.Doc did not respond to a request for comment from Bleeping Computer in time for this article’s publication. Having M.E.Doc at the heart of the outbreak makes sense. According to Kaspersky, 90% of the victims are located in Ukraine and Russia, an area usually covered by the software maker.
Speaking to Bleeping Computer, Costin Raiu, Kaspersky Lab security researcher said the ransomware is based on old code that some people called Petya, but the ransomware is sufficiently different to be in its own class.
This is one of the reasons why so many researchers have started a trend on social media, calling the ransomware NotPetya, after so many reports have referenced it as Petya.
Nevertheless, Malwarebytes researcher Hasherezade, an expert in all things Petya, attributes the NotPetya strain to the same author who created the original Petya, Mischa, and GoldenEye ransomware strands.
Cisco’s and Kaspersky’s researchers also uncovered new details regarding the ransomware’s execution. According to researchers, the ransomware first infects systems via the tainted M.E.Doc software update.
The ransomware then uses password harvesting tools to gather credentials for the local network, which it then passes to tools such as PsExec and WMIC. These tools use these passwords to spread to new computers on the same network.
Furthermore, the NotPetya ransomware also uses two NSA exploits leaked by the Shadow Brokers in April 2017. These are ETERNALBLUE (also used by WannaCry) and ETERNALROMANCE.
NotPetya uses these two exploits to spread via LAN to other computers. Unlike WannaCry, NotPetya will spread only via LAN, and not via the Internet.
According to MalwareTech, the man who discovered the WannaCry killswitch, NotPetya is not as dangerous as WannaCry.
“The current Petya attack is different in the sense that the exploits it uses are only used to spread across a local network rather than the internet,” he says. ” Due to the fact networks are of limited size and fairly quick to scan, the malware would cease spreading once it has finished scanning the local network and therefore is not anywhere near as infectious as WannaCry, which still continues to spread.”
Furthermore, the expert estimates NotPetya distribution has stopped. “The important difference between WannaCry and Petya is WannaCry was likely deployed onto a small number of computers and then spread rapidly, whereas Petya seem to have been deployed onto a large number of computers and spread via local network; therefore, in this instance there is low risk of new infections more than 1h after the attack,” MalwareTech says. “The malware shuts down the computer to encrypt it 1h after execution, by which time it will already have completed its local network scan.”
