The MeDoc Connection
Summary: Cisco Talos found that the Nyetya attack was delivered through the update system of M.E.Doc, a widely used Ukrainian accounting package made by Intellect Service, after an actor used stolen administrator credentials to gain root and reconfigure the NGINX server to proxy update traffic to an actor-controlled host at 176.31.182.167. Ukraine Cyber police confirmed over 2,000 affected companies in Ukraine alone, and Talos assesses with high confidence that the attack was destructive rather than economically motivated.
What's compelling: The actor burned a backdoor in ZvitPublishedObjects.dll and control of the update server to reach users of software used by 80% of Ukrainian businesses, including multinationals operating there - a supply chain position that took stolen credentials and a modified DLL to exploit.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026