Summary
Every catastrophe has a patient zero. For NotPetya, the most destructive cyberattack in history, it was M.E.Doc, a Ukrainian tax-accounting program used by the overwhelming majority of the country's companies (around 80% of the accounting-software market). Russia's Sandworm group had quietly hijacked M.E.Doc's software update servers, so when companies installed routine updates in 2017, they installed a backdoor instead. From that single poisoned channel, NotPetya spread across the world. This page covers the supply-chain entry point; the global outbreak it caused is its own story. It is the lesson that a trusted software update is one of the most dangerous things you can run, because you are running whatever the vendor's compromised server hands you.
How it happened
M.E.Doc is a Ukrainian accounting and tax-reporting product, and like most such software it updates itself automatically. Russia's Sandworm group (part of the GRU military intelligence) compromised M.E.Doc's update servers and, across at least three separate updates in April, May, and June 2017, planted a backdoor hidden inside a legitimate program module (ZvitPublishedObjects.dll). On 27 June 2017 they triggered NotPetya through that already-installed backdoor (not a fresh same-day update), hitting thousands of Ukrainian organisations that had done nothing more than keep their accounting software up to date.
The backdoor was patient and espionage-grade: it harvested each victim's unique business-registration code (the EDRPOU number) so the attackers could fingerprint specific organisations, and it used M.E.Doc's own update server as its command channel, hiding stolen data inside HTTP cookies so the traffic looked legitimate. The same channel had even been used to push a smaller ransomware strain (XData) weeks earlier. Once NotPetya detonated it propagated laterally using the EternalBlue exploit and the Mimikatz credential-stealing tool, and although it presented itself as ransomware, it was a wiper built for destruction, not profit. The trusted update channel was the weapon: a supply-chain attack that turned a mundane software update into the seed of a global disaster.
The damage
NotPetya hit more than 12,500 machines in Ukraine directly and spread to over 60 countries, causing billions of dollars in damage to companies like Maersk, Merck, and FedEx. M.E.Doc's vendor had ignored security warnings, and when Ukrainian police seized its servers they found them running without security updates since 2013. The US later indicted six GRU officers over the attack. The full scale of the outbreak, including Maersk's multi-billion-dollar recovery, is documented separately.
Why M.E.Doc still matters
It is the supply-chain entry lesson in its starkest form: a single compromised software vendor's update server seeded a global wiper. Trusted auto-updates are an attack surface, so prefer signed updates with verified provenance, monitor what third-party software executes, and segment networks so a poisoned update cannot reach the entire estate. And for vendors, the lesson is that securing your build and update infrastructure protects not just you but everyone downstream, M.E.Doc's neglect helped cost the world billions. It follows the same update-server-compromise pattern as CCleaner and SolarWinds, and the global outbreak it triggered is covered on the NotPetya page.
How to fix it
- Isolate and rebuild any system that ran the backdoored M.E.Doc update from known-good media, and restore from offline backups.
- Block the malicious update and remove the M.E.Doc auto-update path until the vendor's servers are confirmed clean.
- Treat the trusted-update vector as a supply-chain compromise and hunt for the lateral movement that followed.
How to avoid it
- Treat third-party software auto-updates as a supply-chain risk: prefer signed updates with verified provenance, and monitor what updated software executes.
- Segment networks so a poisoned update on one host cannot spread across the estate.
- Maintain tested, offline backups so a destructive payload delivered through an update is recoverable.
- For vendors: harden and isolate your build and update infrastructure; its compromise endangers every downstream customer.
References
- https://blog.talosintelligence.com/the-medoc-connection/
- https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/
- https://www.justice.gov/archives/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware-and
- https://www.microsoft.com/en-us/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
- https://www.bankinfosecurity.com/notpetya-patient-zero-ukrainian-accounting-software-vendor-a-10080
Related vulnerabilities
All Supply chain →- CRITICALGHSA-93qj-5q5v-3c2h
Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
- CRITICALNPM-REDHAT-MIASMA-2026
In June 2026 the npm supply-chain worm finally produced something genuinely new and frightening: malicious packages that were signed and carried valid build provenance. Attackers used a compromised GitHub account inside Red Hat's own organisation to publish trojanised versions of 31 packages in the @redhat-cloud-services namespace through Red Hat's legitimate CI pipeline, so the poisoned releases arrived with authentic attestations proving they were built by the real build system. The payload, nicknamed Miasma, was a lightly re-skinned copy of Mini Shai-Hulud, a worm that a group called TeamPCP had open-sourced for anyone to reuse weeks earlier. No Red Hat customers were harmed, because Red Hat strips install scripts before deployment, but the permanent lesson is uncomfortable: a signature proves where a package was built, not that the build was clean.
- CRITICALNPM-AXIOS-2026
On 31 March 2026 the single most widely used HTTP client in the JavaScript world was turned into malware for about three hours. Axios carries well over 100 million weekly downloads and sits as a transitive dependency underneath a huge share of the npm ecosystem, so when a North Korea-nexus actor took over the maintainer's account and published two booby-trapped versions, the blast radius was enormous even though the bad versions were live only for one early-morning window. The poisoned releases pulled in a hidden dependency that ran on install and dropped a cross-platform remote access trojan onto developer machines and CI runners. It is the case study in why a few hours of a popular package being compromised is still a global incident, and in why a maintainer's own laptop is now a nation-state target.
- HIGHSC-NOTEPADPP-CHRYSALIS-2025
In 2025, a Chinese state-linked espionage group hijacked the update channel of Notepad++, one of the most widely installed Windows text editors, to plant a custom backdoor on a handful of carefully chosen targets. The attackers never touched Notepad++'s source code or its signing keys. Instead they compromised the third-party shared-hosting server that delivered updates, and abused the fact that the WinGUp updater shipped without any integrity check on what it downloaded (tracked as CVE-2025-15556). For machines on their target list, WinGUp was silently redirected to attacker-controlled servers that served a trojanized installer; everyone else kept receiving the genuine update. The campaign ran from roughly June to December 2025 and was only made public in February 2026 by Rapid7, with Kaspersky and Broadcom/Symantec corroborating it independently.
- HIGHSC-ESCAN-RELOAD-2026
On or around January 20, 2026, attackers who had broken into a regional update server for eScan, the antivirus product made by India's MicroWorld Technologies, pushed a trojanized Reload.exe through the legitimate update channel during a window of roughly two hours. The security software itself became the delivery vehicle for malware. The malicious binary carried eScan's code-signing identity, but its signature was actually invalid; it ran anyway because the updater trusted the channel rather than rigorously validating the signature. Once on a host, the malware rewrote the Windows HOSTS file to cut eScan off from its own update servers, blinded script scanning, and reached out to takedown-resistant command-and-control hosted on blockchain naming systems. Morphisec disclosed the campaign, with Kaspersky and Darktrace corroborating it independently.
- CRITICALNPM-SHAI-HULUD-2-2025
Shai-Hulud is the nightmare the npm ecosystem had long feared: a self-replicating worm. First seen in September 2025 and back in a more aggressive wave around 21-24 November 2025 ("The Second Coming"), it does not just poison one package and wait. When its malware runs in a developer's environment, it harvests every secret it can find, npm tokens, GitHub tokens, cloud keys, then uses those stolen npm tokens to automatically publish itself into other packages the victim maintains, spreading from maintainer to maintainer on its own. The second wave hit more than 25,000 GitHub repositories across roughly 500 compromised accounts, leaked the stolen secrets into public repos, and, if it failed to steal credentials, tried to wipe the victim's home directory. It is the moment supply-chain malware learned to propagate like a biological infection.