Cisco’s security research organization Talos’ initial analysis of the global ransomware worm attack that has affected multiple organizations worldwide points to the attack starting in the Ukraine, possibly from software update systems for a Ukrainian tax accounting package called MeDoc.
This appears to have been confirmed by MeDoc itself.
MeDoc is a widely used tax software used by many organizations in or doing business with Ukraine.
There have been other reports of this attack appearing in France, Denmark, Spain, the UK, Russia and the US.
What’s clear from this, and recent attacks, is that organizations must prioritize patching systems to lower their risk profile.
We have to patch as quickly as we can. In addition, making back-ups of key data is a fundamental of any security program.
This ransomware outbreak has affected multiple organisations in several countries today, Cisco’s security research organisation Talos is actively investigating this new malware variant.
This new ransomware variant encrypts the master boot record (MBR) of a system. Think of the MBR as the table of contents for your hard drive – clearly very important.
Talos’ initial analysis points to the attack starting in the Ukraine, possibly from software update systems for a Ukrainian tax accounting package called MeDoc.
This appears to have been confirmed by MeDoc.
Reported victims so far include Ukrainian infrastructure like power companies, airports, public transit, and the central bank, as well as Danish shipping company Maersk, pharmaceutical company Merck, the Russian oil giant Rosnoft, and institutions in India, Spain, France, the United Kingdom, and beyond.
Cisco’s security research organization Talos’ initial analysis points to the attack starting in the Ukraine, possibly from software update systems for a Ukrainian tax accounting package called MeDoc.
This appears to have been confirmed by MeDoc itself. MeDoc is a widely used tax software used by many organizations in or doing business with Ukraine.
This ransomware doesn’t seem to incorporate the errors that hindered WannaCry from spreading.
Specifically, this attack doesn’t seem to have a kill switch function.
It is also harder to detect since it moves within a network.
It is not scanning of the internet like WannaCry did.
If vulnerabilities aren’t patched, an organization will continue to be at risk for infection by this ransomware.
To learn more visit http://www.cisco.com/c/en/us/solutions/enterprise-networks/ransomware-defense/index.html?