This article is more than 1 year old
Watch: Armed Ukrainian cyber-cops raid MeDoc in NotPetya probe
Equipment seized to head off new attack, we're told
Video There's a new wrinkle to the NotPetya story: authorities in Ukraine have seized equipment from MeDoc, the accounting software maker implicated in spreading the malware.
The country's anti-cybercrime unit has seized the developer's servers after saying it had detected new activity, and was acting to “immediately stop the uncontrolled proliferation” of malware.
Associated Press's Raphael Satter quotes a police spokesperson, Yulia Kvitko, as saying the company's systems had either sent or were preparing to send a new (presumably compromised) update.
The cyber-plod says the company's management and staff fully assisted in the investigation, adding that equipment will be “sent for detailed analysis”. A video of the armed raid was posted on YouTube by the cops:
Officers now recommend people stop using the software until further notice, turn off any computers it's installed on, and change their passwords. Cisco's security peeps have also published an analysis of how MeDoc's systems were commandeered to infect victims with NotPetya. ESET has also described in detail how the malware spread via a malicious MeDoc update.
In another twist, Kaspersky Lab analyst Aleks Gostev says the Bitcoin collected in the original attack has been withdrawn and a statement (which Vulture South can't verify) posted to an Onion text site.
And finally they withdraw everything ! Time to hunt, eh ? :) #notPetya money goes away pic.twitter.com/dE8RPtTPNj
— codelancer (@codelancer) July 4, 2017
It would be funny to track next transactions https://t.co/Rp6jmkML6H https://t.co/lwLgdiz2wS
— codelancer (@codelancer) July 4, 2017
"Send me 100 Bitcoins and you will get my private key to decrypt any harddisk (except boot disks)" - well, and where is BTC address ? :) https://t.co/vMx4f8fOex
— codelancer (@codelancer) July 4, 2017
The AP story says the Ukrainian infrastructure ministry alone has incurred “millions” in the costs of the attack, which hit two servers and hundreds of workstations. ®
Biting the hand that feeds IT
