Know Your Value</s>Ukrainian police on Tuesday seized the servers of an accounting software firm suspected of spreading a malware virus which crippled computer systems at major companies around the world last week, a senior police official said.

The head of Ukraine's Cyber Police, Serhiy Demedyuk, told Reuters the servers of M.E.Doc - Ukraine's most popular accounting software - had been seized as part of an investigation into the attack.

Though they are still trying to establish who was behind last week's attack, Ukrainian intelligence officials and security firms have said some of the initial infections were spread via a malicious update issued by M.E.Doc, charges the company's owners deny.</s>KIEV, Ukraine — Ukrainian police on Tuesday seized the servers of an accounting software firm suspected of spreading a malware virus the crippled computer systems at major companies around the world last week, a senior police official said.

The head of Ukraine's Cyber Police, Serhiy Demedyuk, told Reuters that the servers of M.E.Doc — Ukraine's most popular accounting software — had been seized as part of an investigation into the attack.

Although they are still trying to establish who was behind last week's attack, Ukrainian intelligence officials and security firms have said some of the initial infections were spread via a malicious update issued by M.E.Doc, allegations that the company's owners deny.

The owners weren't immediately available for comment on Tuesday.

Premium Service, which says it is an official dealer of M.E.Doc's software, wrote a post on M.E.Doc's Facebook page saying that masked men were searching M.E.Doc's offices and that the software firm's servers and services were down.

Premium Service couldn't be reached for further comment. Cyber Police spokeswoman Yulia Kvitko said further comment would be made Wednesday.

The police move came after cybersecurity investigators unearthed further evidence on Tuesday that the attack had been planned months in advance by highly skilled hackers, who they said had inserted a vulnerability into the M.E.Doc program.

Researchers at the Slovakian security software firm ESET said they had found a "backdoor" written into some of M.E.Doc's software updates, likely with access to the company's source code, which allowed hackers to enter companies' systems undetected.

"We identified a very stealthy and cunning backdoor that was injected by attackers into one of M.E.Doc's legitimate modules," senior malware researcher Anton Cherepanov said in a technical note. "It seems very unlikely that attackers could do this without access to M.E.Doc's source code."

"This was a thoroughly well-planned and well-executed operation," he said.

Oleg Derevianko, board chairman at Ukrainian cyber security firm ISSP, said an update issued by M.E.Doc in April delivered a virus to the company's clients, which instructed computers to download 350 megabytes of data from an unknown source on the internet.

The virus then exported 35 megabytes of company data to the hackers, he told Reuters in an interview at his office in Kiev.

"With this 35 megabytes, you can exfiltrate anything — emails from all of the banks, user accounts, passwords, anything."

Ukrainian intelligence officials accused Russian security services on Saturday of being behind the attack, and cybersecurity researchers linked it to a suspected Russian group that attacked the Ukrainian power grid in December.

M.E.Doc is little known outside Ukrainian accounting circles, but it is used by around 80 percent of companies in Ukraine. The software allows its 400,000 clients to send and collaborate on financial documents among internal departments, as well as file them with the Ukrainian state tax service.

Ukraine's government said Tuesday that it would submit a draft law to Parliament to extend the country's tax deadline to July 15 and to waive fines for companies that missed the June 13 cutoff because of the attack.</s>Ukrainian police have seized the computer servers of Ukrainian accounting software firm M.E.Doc as part of an investigation into last week's cyber attack, Cyber Police Chief Serhiy Demedyuk told Reuters on Tuesday.

KIEV: Ukrainian police have seized the computer servers of Ukrainian accounting software firm M.E.Doc as part of an investigation into last week's cyber attack, Cyber Police Chief Serhiy Demedyuk told Reuters on Tuesday.

Ukrainian officials and security firms have said some of the initial infections occurred when malware was transmitted via a malicious update issued by M.E.Doc, which is Ukraine's most popular accounting software.

M.E.Doc's developers told Reuters on Monday their servers were not compromised by the hackers and that updates it issued to clients were not infected. They were not immediately available for comment on Tuesday.</s>Ukrainian police have seized the computer servers of Ukrainian accounting software firm M.E.Doc as part of an investigation into last week's cyber attack, Cyber Police Chief Serhiy Demedyuk told Reuters on Tuesday.

Ukrainian officials and security firms have said some of the initial infections occurred when malware was transmitted via a malicious update issued by M.E.Doc, which is Ukraine's most popular accounting software.

M.E.Doc's developers told Reuters on Monday their servers were not compromised by the hackers and that updates it issued to clients were not infected. They were not immediately available for comment on Tuesday. (Reporting by Pavel Polityuk; Writing by Jack Stubbs; Editing by Matthias Williams)</s>The Ukrainian police seized the servers of the firm that created the MeDoc accounting software, which is believed to be the starting point for the NotPetya ransomware attack that struck in June.

The Associated Press reported that the head of the Ukrainian Cyberpolice Col. Serhiy Demydiuk had said the company, M.E. Doc, had ignored repeated warnings that its systems were susceptible to cyberattack. MeDoc software is widely used by tax firms

“For this neglect, the people in this case will face criminal responsibility,” Demydiuk told the AP.

It is now widely accepted that the attack most likely started when hackers allegedly compromised the update server of Ukrainian accounting software company M.E. Doc so that it would dispense NotPetya to unsuspecting victims. Indeed, Check Point Software Technologies has reported that in May the same company is suspected to was involved in the distribution of XData ransomware.</s>Ukrainian police on Tuesday seized the servers of an accounting software firm suspected of spreading a malware virus which crippled computer systems at major companies around the world last week, a senior police official said.

The head of Ukraine’s Cyber Police, Serhiy Demedyuk, told Reuters the servers of M.E.Doc — Ukraine’s most popular accounting software — had been seized as part of an investigation into the attack.

Though they are still trying to establish who was behind last week’s attack, Ukrainian intelligence officials and security firms have said some of the initial infections were spread via a malicious update issued by M.E.Doc, charges the company’s owners deny.

The owners were not immediately available for comment on Tuesday.

Premium Service, which says it is an official dealer of M.E.Doc’s software, wrote a post on M.E.Doc’s Facebook page saying masked men were searching M.E.Doc’s offices and that the software firm’s servers and services were down.

Premium Service could not be reached for further comment.

Cyber Police spokeswoman Yulia Kvitko said investigative actions were continuing at M.E.Doc’s offices, adding that further comment would be made on Wednesday.

The police move came after cybersecurity investigators unearthed further evidence on Tuesday that the attack had been planned months in advance by highly skilled hackers, who they said had inserted a vulnerability into the M.E.Doc program.

Ukraine also took steps on Tuesday to extend its state tax deadline by one month to help businesses hit by the malware assault.

Researchers at Slovakian security software firm ESET said they had found a “backdoor” written into some of M.E.Doc’s software updates, likely with access to the company’s source code, which allowed hackers to enter companies’ systems undetected.

“We identified a very stealthy and cunning backdoor that was injected by attackers into one of M.E.Doc’s legitimate modules,” ESET senior malware researcher Anton Cherepanov said in a technical note. “It seems very unlikely that attackers could do this without access to M.E.Doc’s source code.”

“This was a thoroughly well-planned and well-executed operation,” he said.

ESET said at least three M.E.Doc updates had been issued with the “backdoor vulnerability,” and the first one was sent to clients on April 14, more than two months before the attack.

ESET said the hackers likely had access to M.E.Doc’s source code since the beginning of the year, and the detailed preparation before the attack was testament to the advanced nature of their operation.

Oleg Derevianko, board chairman at Ukrainian cyber security firm ISSP, said an update issued by M.E.Doc in April delivered a virus to the company’s clients which instructed computers to download 350 megabytes of data from an unknown source on the internet.

The virus then exported 35 megabytes of company data to the hackers, he told Reuters in an interview at his office in Kiev.

“With this 35 megabytes you can exfiltrate anything — emails from all of the banks, user accounts, passwords, anything.”

Little known outside Ukrainian accounting circles, M.E.Doc is used by around 80 percent of companies in Ukraine. The software allows its 400,000 clients to send and collaborate on financial documents between internal departments, as well as file them with the Ukrainian state tax service.

Ukraine’s government said on Tuesday it would submit a draft law to parliament for the country’s tax deadline to be extended to July 15, and waive fines for companies who missed the previous June 13 cutoff because of the attack.

“We had program failures in connection to the cyberattack, which meant that businesses were unable to submit account reports on time,” Prime Minister Volodymyr Groysman told a Cabinet meeting.

Separately, Ukraine’s security service, the SBU, said it had discussed cyberdefense with NATO officials and had received equipment from the alliance to better combat future cyberattacks. Ukraine is not in NATO but is seeking closer ties.

On Saturday Ukrainian intelligence officials accused Russian security services of being behind the attack, and cybersecurity researchers linked it to a suspected Russian group who attacked the Ukrainian power grid in December 2016.

Derevianko said the hackers’ activity in April and reported access to M.E.Doc’s source code showed Ukraine’s computer networks had already been compromised and that the intruders were still operating inside them.

“It definitely tells us about the advanced capabilities of the adversaries,” he said. “I don’t think any additional evidence is needed to attribute this to a nation-state attack.”</s>Police in Ukraine have seized the servers of one of the largest accounting software firms in the country, after it was suspected that a malware virus which hit dozens of global enterprises last week had spread via its malicious update.

As part of an investigation into one of the largest recent cyber attacks, the servers of Ukraine's most popular accounting software, M.E.Doc were seized by Ukrainian police Tuesday, Reuters reported, citing the head of Ukraine's Cyber Police, Sergey Demedyuk.

Ukrainian intelligence officials and security firms experts believe initial infections, which affected thousands of computers worldwide, might have been spread via the accounting firm’s updates, Reuters reports.

While it is still unclear who inserted a vulnerability into the M.E.Doc program, the Kiev-based firm whose software is used by around 80 percent of companies in Ukraine is under investigation itself and will face criminal charges, AP reported citing Demedyuk.

M.E.Doc's employees had dismissed repeated warnings about the security of their information technology infrastructure, Demedyuk said in an interview with the news agency.

"They knew about it... They were told many times by various anti-virus firms," he told AP, adding, "for this neglect, the people in this case will face criminal responsibility."

The company whose software allows some 400,000 clients to manage financial documents between internal departments, as well as file them with the Ukrainian state tax service, had initially acknowledged having been hacked, but then deleted its statement, according to AP.

On Tuesday, the Ukrainian government said it would submit a draft law to parliament for the country's tax deadline to be extended this year, as many companies missed it because of the attack.

Last week, dozens of companies in various parts of the world were attacked by ransomware, believed to have originated from Ukraine. In Ukraine itself, the massive cyber attacks targeted the government, banks and airports, and even partly knocked out some radiation monitoring equipment at the Chernobyl nuclear power plant.

Elsewhere in the world, the US-based division of pharmaceutical company Merck, Russian state oil company Rosneft, Danish shipping and oil firm A.P. Moller-Maersk, UK-based advertising and public relations company WPP, and chocolate giant Cadbury in Australia were among those affected.

Kiev has blamed Russia for being behind the cyber attack but failed to present any evidence to support its accusations. The Kremlin dismissed the allegations, having dubbed them as ”unfounded."</s>KIEV, Ukraine — Ukraine’s national cybercrime unit seized servers belonging to a small company at the centre of a global outbreak of malicious software after “new activity” was detected there, the service said in a statement early Wednesday.

The announcement raised the possibility that the hackers behind last week’s wide-ranging cyberattack were still seeking to sow chaos.

Tax software firm M.E. Doc was raided to “immediately stop the uncontrolled proliferation” of malware. In a series of messages, Cyberpolice spokeswoman Yulia Kvitko suggested that M.E. Doc had sent or was preparing to send a new update and added that swift action had prevented any further damage.

“Our experts stopped (it) on time,” she said.

It wasn’t immediately clear how or why hackers might still have access to M.E. Doc’s servers. The company has been the focus of intense attention from authorities and cybersecurity researchers since it was identified as the patient zero of the outbreak, which crippled computers at several multinational firms and knocked out cash machines, gas stations and bank branches in Ukraine.

The company has not returned messages from The Associated Press, but in several statements posted to Facebook it disputed allegations that its poor security helped seed the malware epidemic.

Cyberpolice chief Col. Serhiy Demydiuk previously told AP that M.E. Doc’s owners would be brought to justice, but Kvitko said there had been no arrests.

Adding to the intrigue, the bitcoin wallet linked to the hackers who masterminded the outbreak was emptied around the same time as the police announcement. Kaspersky Lab researcher Aleks Gostev said on Twitter that some of the digital currency had been sent to text storage sites, hinting at the prospect of some kind of a forthcoming statement.

Meanwhile, Ukrainian officials were just beginning to count the costs of the outbreak.

Infrastructure Minister Volodymyr Omelyan told AP his department had incurred “millions” in costs, with hundreds of workstations and two of its six servers knocked out.

Ukrainian officials have yet to put a dollar amount on the total damage or even estimate its scope.</s>The head of Ukraine's Cyber Police, Serhiy Demedyuk, told Reuters the servers of M.E.Doc - Ukraine's most popular accounting software - had been seized as part of an investigation into the attack.

Though they are still trying to establish who was behind last week's attack, Ukrainian intelligence officials and security firms have said some of the initial infections were spread via a malicious update issued by M.E.Doc, charges the company's owners deny.

The owners were not immediately available for comment on Tuesday.

The police move came after cyber security investigators unearthed further evidence on Tuesday that the attack had been planned months in advance by highly-skilled hackers, who they said had inserted a vulnerability into the M.E.Doc program.

Ukraine also took steps on Tuesday to extend its state tax deadline by one month to help businesses hit by the malware assault.
As part of an investigation into the recent cyberattacks, the servers of Ukraine's most popular accounting software company, M.E.Doc, are seized by Ukrainian police.