KIEV--The Ukrainian software firm used to launch last week's global cyber attack warned on Wednesday that all computers sharing a network with its infected accounting software had been compromised by hackers.
The attack used a virus, dubbed "NotPetya" by some experts, to take down thousands of computers in dozens of countries, disrupting shipping and businesses. Investigators now say the hack may be far more nefarious than previously thought.
A top official in the Ukrainian Presidential Administration said it remained unclear how many computers had been compromised and the state security service was trying to establish what the hackers would do with data stolen during the attack.
A video released by Ukrainian police showed masked men in combat fatigues and armed with assault rifles raiding the offices of software developer Intellect Service late on Tuesday, after cyber security researchers said they had found a "back door" written into some of the updates issued by its M.E.Doc accounting software.
M.E.Doc is used by 80 percent of Ukrainian companies and installed on about 1 million computers in the country. Interior Minister Arsen Avakov said police had blocked a second cyber attack from servers hosting the software.
The company previously denied its servers had been compromised but when asked on Wednesday whether a back door had been inserted, Chief Executive Olesya Bilousova said: "Yes, there was. And the fact is that this back door needs to be closed."
Any computer on the same network as machines using M.E.Doc was now vulnerable to another attack, she said. "We need to pay the most attention to those computers which weren't affected (by last week's attack)," she told reporters. "The virus is on them waiting for a signal. There are fingerprints on computers which didn't even use our product."
Dmytro Shymkiv, deputy head of Ukraine's presidential administration and a former director of Microsoft in Ukraine, said the latest evidence further pointed to an advanced and well-orchestrated attack.
"I am looking through the analysis that has been done on the M.E.Doc server, and from what I'm seeing, that's worrying. Worrying is a very light word for this," he said. "How many back doors are still open? We don't know."
