Ukrainian software company and IT services provider SoftServe fell victim to a ransomware attack on September 1 that may have led to theft of their customers' source code.
With more than 8.000 employees and 50 offices worldwide, SoftServe is one of the largest companies in Ukraineand offers software development and IT consulting services.
News of a cyber attack on SoftServe first surfaced on the Telegram DС8044 Kyiv Info channel, where an alleged message was sent by the company to its employees.
"Today at 1 p.m. SoftServe was attacked. The hackers have access to the company's infrastructure and managed to start ransomeware encryption along with some other malware. "
In a later statement on a Ukrainian technology news page, SoftServe confirmed that an attack had taken place, prompting them to disconnect their customers to prevent it from spreading.
"Yes, there was an attack today. The most important consequences of the attack are the temporary loss of functionality of a part of the mail system and the interruption of some of the auxiliary test environments. "As far as we can tell, this is the biggest impact of the attack and the other systems or customer data were not affected."
"To prevent the attack from spreading, we isolated certain parts of our network and restricted communication with networks customers. We are preparing a message to our customers about the situation. At the same time as services are resuming, we are investigating the incident itself, so we are not ready to comment on who exactly did this,” said Adrian Pavlicevic, Senior Vice President of Informatics at SoftServe.
According to the SoftService incident, the attackers exploited a DLL vulnerability that violated the legal application Rainmeter to develop their ransomware.
Rainmeter is a legitimate Windows customization tool that loads a Rainmeter.dll at startup.
During the attack, hackers replaced the legal Rainmeter.dll with a malicious version written from the source code of the application.
According to her scouts VirusTotal, Rainmeter.dll is recognized as Win32 / PyXie.A.
In one reference of BlackBerry since 2019, PyXie is a Python Remote Access (RAT) trojan known to exploit malicious DLL vulnerabilities in other software such as LogMeIn and Google Update.
The researchers of BlackBerry say they have seen data that this RAT has been used in ransomware attacks.
