Today's massive ransomware outbreak was caused by a malicious software update for M.E.Doc, a popular accounting software used by Ukrainian companies.
According to sources, such as Cisco Talos, ESET, Microsoft, MalwareHunter, Kaspersky Lab, Ukrainian Police, and others, an unknown attacker compromised the M.E.Doc update servers, and pushed a malicious software update to customers.
When the update reached M.E.Doc's clients, the tainted software packaged delivered the Petya ransomware — also referenced online as NotPetya, or Petna.
The Ukrainian software vendor appears to have inadvertently confirmed that something was wrong when, this morning, issued a security advisory reading (translated):
Attention! Our servers are carrying out a virus attack. We apologize for the temporary inconvenience!
Hours later, as the ransomware outbreak spread all over Ukraine and other countries across the globe, M.E.Doc denied on Facebook its servers ever served any malware.
According to security researcher MalwareHunter, this is not the first time M.E.Doc has carried a malicious software update that delivered ransomware.
Back in May, the company's servers were also compromised and suspected of carrying the XData ransomware, which caused quite a lot of havoc in the Ukraine at the time it was first spotted. M.E.Doc denied its software update servers were involved in that attack as well.
M.E.Doc did not respond to a request for comment from Bleeping Computer in time for this article's publication. Having M.E.Doc at the heart of the outbreak makes sense. According to Kaspersky, 90% of the victims are located in Ukraine and Russia, an area usually covered by the software maker.
Speaking to Bleeping Computer, Costin Raiu, Kaspersky Lab security researcher said the ransomware is based on old code that some people called Petya, but the ransomware is sufficiently different to be in its own class.
This is one of the reasons why so many researchers have started a trend on social media, calling the ransomware NotPetya, after so many reports have referenced it as Petya.
Nevertheless, Malwarebytes researcher Hasherezade, an expert in all things Petya, attributes the NotPetya strain to the same author who created the original Petya, Mischa, and GoldenEye ransomware strands.
Cisco's and Kaspersky's researchers also uncovered new details regarding the ransomware's execution. According to researchers, the ransomware first infects systems via the tainted M.E.Doc software update.
The ransomware then uses password harvesting tools to gather credentials for the local network, which it then passes to tools such as PsExec and WMIC. These tools use these passwords to spread to new computers on the same network.
Furthermore, the NotPetya ransomware also uses two NSA exploits leaked by the Shadow Brokers in April 2017. These are ETERNALBLUE (also used by WannaCry) and ETERNALROMANCE.
NotPetya uses these two exploits to spread via LAN to other computers. Unlike WannaCry, NotPetya will spread only via LAN, and not via the Internet.
According to MalwareTech, the man who discovered the WannaCry killswitch, NotPetya is not as dangerous as WannaCry.
"The current Petya attack is different in the sense that the exploits it uses are only used to spread across a local network rather than the internet," he says. " Due to the fact networks are of limited size and fairly quick to scan, the malware would cease spreading once it has finished scanning the local network and therefore is not anywhere near as infectious as WannaCry, which still continues to spread."
Furthermore, the expert estimates NotPetya distribution has stopped. "The important difference between WannaCry and Petya is WannaCry was likely deployed onto a small number of computers and then spread rapidly, whereas Petya seem to have been deployed onto a large number of computers and spread via local network; therefore, in this instance there is low risk of new infections more than 1h after the attack," MalwareTech says. "The malware shuts down the computer to encrypt it 1h after execution, by which time it will already have completed its local network scan."
As MalwareTech explained, after one hour the ransomware reboots the user's PC, an event which starts the encryption process. This process is disguised as a CHKDSK operation.
Users can use this screen as a clue to power off their PCs, which stops the ransomware from encrypting their files.
I can confirm 100% that so long as you do not go past the CHKDSK message, your files are safe and you can recover from a LiveCD. #Petya— Hacker Fantastic (@hackerfantastic) June 27, 2017
The encryption process uses a dual AES-128 and RSA-2048 standard encryption model, used by most top-notch ransomware families, meaning there's little hope to see a decrypter.
Fortunately, Cybereason security researcher Amit Serper has found a way to stop Petya/NotPetya from taking root in the first place. Bleeping Computer has published a how-to guide on how to protect your computer from NotPetya.