Petya Ransomware Outbreak Originated in Ukraine via Tainted Accounting Software

[LASER_oneXM]

...some quotes from the artcle:

Today's massive ransomware outbreak was caused by a malicious software update for M.E.Doc, a popular accounting software used by Ukrainian companies.

According to sources, such as Cisco Talos, ESET, MalwareHunter, Kaspersky Lab, Ukrainian Police, and others, an unknown attacker compromised the M.E.Doc update servers, and pushed a malicious software update to customers.

When the update reached M.E.Doc's clients, the tainted software packaged delivered the Petya ransomware — also referenced online as NotPetya, or Petna.

Petya is NotPetya
Speaking to Bleeping Computer, Costin Raiu, Kaspersky Lab security researcher said the ransomware is based on old code that some people called Petya, but the ransomware is sufficiently different to be in its own class.

This is one of the reasons why so many researchers have started a trend on social media, calling the ransomware NotPetya, after so many reports have referenced it as Petya.

Nevertheless, Malwarebytes researcher Hasherezade, an expert in all things Petya, attributes the NotPetya strain to the same author who created the original Petya, Mischa, and GoldenEye ransomware strands.

More details about infection routine

Cisco's and Kaspersky's researchers also uncovered new details regarding the ransomware's execution. According to researchers, the ransomware first infects systems via the tainted M.E.Doc software update.


The ransomware then uses password harvesting tools to gather credentials for the local network, which it then passes to tools such as PsExec and WMIC. These tools use these passwords to spread to new computers on the same network.


Furthermore, the NotPetya ransomware also uses two NSA exploits leaked by the Shadow Brokers in April 2017. These are ETERNALBLUE (also used by WannaCry) and ETERNALROMANCE.


NotPetya uses these two exploits to spread via LAN to other computers. Unlike WannaCry, NotPetya will spread only via LAN, and not via the Internet.

 

[SHvFl]

Interesting info.
Petya Ransomware Attack – What’s Known | MalwareTech