NotPetya, a variant of the Petya ransomware, first came to the public wearing the ransomware label. It was spread through M.E.Doc accounting software servers, causing extensive damage to organizations in Ukraine and across the world.

Subsequent analysis by IBM showed that the payload was deficient in its ability to reconstitute the encoded data. Researchers classified the exploit as wiperware, not ransomware, and determined that its operators aimed to destroy the data rather than hold it hostage for financial gain.

Backdoors Installed Through Malicious M.E.Doc Updates

According to recent reports, the servers that injected the malware had been compromised three times before the final payload was spread. Cisco Talos reported that threat actors created a backdoor inside M.E.Doc disguised as a software update. Each of the three breaches masked an attempt to update a potential victim’s machine with different versions of the backdoor, and each version improved the backdoor’s efficiency.

“The result is an XML file that could contain several commands at once,” a researcher wrote for We Live Security. “This remote control feature makes the backdoor a fully featured cyberespionage and cybersabotage platform at the same time.”

Fraudsters also placed a PHP webshell on the compromised web server to establish direct control of the backdoor on infected machines. The server’s nginx.conf file accessed a different server to control the actual spread of the malware. A Ukrainian government official told Reuters that the server had not been patched in any significant way since 2013.

Bleeping Computer noted that threat actors likely belong to the TeleBots cybergang, which has been linked to electricity grid attacks in Ukraine.

What’s Next?

This sophisticated approach could enable cybercriminals to deliver destructive malware to the 80 percent of Ukranian businesses that use the accounting software. The Ukranian government seized the servers just as the cybergang was about to launch a second wave of attacks at the beginning of July.

The situation leaves a foul taste in the security palate: The operators gave up this specialized tool of great destruction, which should leave professionals wondering what they have waiting in the background to replace it.

More from

Are you ready to build your organization’s digital trust?

4 min read - As organizations continue their digital transformation journey, they need to be able to trust that their digital assets are secure. That’s not easy in today’s environment, as the numbers and sophistication of cyberattacks increase and organizations face challenges from remote work and insider behavior. Digital trust can make your organization’s digital transformation stronger. A lack of digital trust can do irreparable harm. However, according to ISACA’s State of Digital Trust 2023 report, too many organizations struggle to define and implement…

Most organizations want security vendor consolidation

4 min read - Cybersecurity is complicated, to say the least. Maintaining a strong security posture goes far beyond knowing about attack groups and their devious TTPs. Merely understanding, coordinating and unifying security tools can be challenging. We quickly passed through the “not if, but when” stage of cyberattacks. Now, it’s commonplace for companies to have experienced multiple breaches. Today, cybersecurity has taken a seat in core business strategy discussions as the risks and costs have risen dramatically. For this reason, 75% of organizations…

How IBM secures the U.S. Open

2 min read - More than 15 million tennis fans around the world visited the US Open app and website this year, checking scores, poring over statistics and watching highlights from hundreds of matches over the two weeks of the tournament. To help develop this world-class digital experience, IBM Consulting worked closely with the USTA, developing powerful generative AI models that transform tennis data into insights and original content. Using IBM watsonx, a next-generation AI and data platform, the team built and managed the entire…

How the FBI Fights Back Against Worldwide Cyberattacks

5 min read - In the worldwide battle against malicious cyberattacks, there is no organization more central to the fight than the Federal Bureau of Investigation (FBI). And recent years have proven that the bureau still has some surprises up its sleeve. In early May, the U.S. Department of Justice announced the conclusion of a U.S. government operation called MEDUSA. The operation disrupted a global peer-to-peer network of computers compromised by malware called Snake. Attributed to a unit of the Russian government Security Service,…