the attack originated from an update of a Ukrainian tax accounting package called MeDoc (
M.E.Doc [
uk]), developed by Intellect Service.[2] MeDoc is widely used among tax accountants in Ukraine,[15] and the software was the main option for accounting for other Ukrainian businesses, according to
Mikko Hyppönen, a security expert at
F-Secure.[2] MeDoc had about 400,000 customers across Ukraine, representing about 90% of the country's domestic firms[8] and prior to the attack was installed on an estimated 1 million computers in Ukraine.[16]
MeDoc provides periodic updates to its program through an update server. On the day of the attack, 27 June 2017, an update for MeDoc was pushed out by the update server, following which the ransomware attack began to appear. British malware expert
Marcus Hutchins claimed "It looks like the software's automatic update system was compromised and used to download and run malware rather than updates for the software."[2]