Poisoned Pipeline / Incidents / AS71
NotPetya via M.E.Doc accounting-software updates
Windows softwareLinux distro / packagesInstaller / update channel
On 27 June 2017 Diskcoder.C (NotPetya / ExPetr) wiped machines across
Ukraine and companies with VPN links into Ukraine. ESET showed the
initial vector was a supply-chain push through M.E.Doc, Ukrainian
accounting software: a PHP backdoor (medoc_online.php) on the vendor
update/FTP server let TeleBots ship a malicious update that applied
without user interaction. The same channel had earlier delivered
Win32/Filecoder.AESNI.C (XData). NotPetya then spread inside LANs via
EternalBlue/DoublePulsar, Mimikatz + PsExec, and WMI. MBR encryption
was modified so recovery was impossible; the ransom screen was a
decoy. First-party write-up: ESET WeLiveSecurity, 30 June 2017.
Mapped techniques
- T0209 Compromise package registry or CDN origin
- T0121 Compromised legitimate artifact
- T0138 Backdoor in code
- T0159 Malicious artifact execution
supply-chain poisoned vendor updater
M.E.Doc update/FTP server hosted a PHP backdoor and pushed the update.
Automatic M.E.Doc updates carried Diskcoder.C.
medoc_online.php on the vendor server; TeleBots VBS backdoors earlier.
Update applied without user interaction, then LAN worming.