Klo

Profile narrative

The organisation develops tax accounting software that is used extensively within Ukraine. Its product is intended to help businesses and government entities meet local tax reporting requirements. The software's wide adoption across Ukrainian organisations made it a notable component of the country's fiscal infrastructure. By focusing on the specific regulatory environment of Ukraine, the organisation has become a key provider of compliance tools for the domestic market. The solution is marketed to a range of sectors including finance, manufacturing, and services.

Public descriptions note that the software is widely used across Ukrainian organisations, which meant its update mechanism could reach a large number of potential targets. In June 2017, attackers compromised the software's update server to distribute a modified version of the NotPetya ransomware. The malicious update appeared legitimate to users, allowing the malware to install silently when the routine update process was executed. Consequently, the compromise affected numerous entities that relied on the software for daily tax operations.

The ransomware incident is notable for its dual purpose of disruption and data destruction rather than financial extortion. Once executed, the malware exploited known Windows vulnerabilities to propagate laterally within networks, affecting not only the initial victims but also partner organisations worldwide. The attack caused operational paralysis at multinational corporations in sectors such as shipping, healthcare, and manufacturing, leading to significant downtime and data loss. Attribution efforts by cybersecurity firms and government agencies linked the operation to Russian military‑linked groups, citing prior patterns of hostile cyber activity against Ukraine. The incident resulted in estimated damages in the billions of dollars, with Ukraine experiencing the highest concentration of infections.

Details regarding the organisation's ownership structure, parent companies, or subsidiary relationships are not disclosed in the sources consulted. The organisation continues to operate under the alias Klo in certain threat‑intelligence references. Its role in the 2017 NotPetya episode remains a reference point for discussions on supply‑chain security and software update integrity. No further public information about subsequent organisational changes or product developments is available in the provided material.

Incidents

1 incident linked to this organisation.