Pershyi Natsionalnyi

Profile narrative

Pershyi Natsionalnyi is a Ukrainian organization that developed and distributed a widely used tax accounting software application known as M.E.Doc. The software served as a critical business tool for Ukrainian companies, enabling them to file tax reports and maintain compliance with government regulatory requirements. As one of the primary software providers in this niche market, Pershyi Natsionalnyi held a significant position within Ukraine's digital business infrastructure, with its product installed across a substantial portion of the country's corporate sector. The organization's reach extended throughout Ukraine, where tax compliance software is mandatory for businesses operating across virtually every industry.

On June 27, 2017, Pershyi Natsionalnyi became the central vector in one of the most destructive cyberattacks in history. Security researchers determined that attackers compromised the software update mechanism of M.E.Doc, embedding malicious code into legitimate software updates that were automatically distributed to users. This supply chain compromise allowed the malware, which became known as NotPetya, to propagate rapidly across Ukrainian networks before spreading to multinational corporations and infrastructure operators worldwide. The attack primarily impacted Ukrainian banks, government ministries, and critical infrastructure operators, while also causing billions of dollars in damages to global businesses. Investigations revealed that the attackers had maintained a foothold in Pershyi Natsionalnyi's infrastructure for approximately six weeks prior to the attack, deliberately choosing a date coinciding with Ukraine's Constitution Day to maximize disruption. Security assessments attributed the operation to Russian military actors, citing parallels to previous cyber operations targeting Ukrainian systems as part of broader hybrid warfare efforts.

The malware deployed through M.E.Doc was technically distinct from conventional ransomware despite its surface appearance. While it displayed ransom notes demanding payment in Bitcoin, the code was designed to cause irreversible destruction rather than enable recovery. The malware overwrote master boot records and encrypted files in ways that made restoration impossible even if victims paid the ransom. This technical sophistication and the targeting of Ukrainian-specific software infrastructure positioned the incident as a deliberate act rather than opportunistic cybercrime. Ukrainian authorities and international allies characterized the event as part of ongoing efforts to destabilize Ukraine through coordinated digital and conventional means, with the choice of a tax software provider reflecting an understanding of the critical role such applications play in the country's economic operations.

The incident exposed significant vulnerabilities in software supply chain security, particularly regarding mandatory business software that handles sensitive regulatory data. Organizations affected included major international corporations with operations in Ukraine, whose networks were compromised when the malicious update propagated through their local subsidiaries. The event prompted renewed examination of update verification mechanisms and third-party software risks across the cybersecurity industry, though specific structural details about Pershyi Natsionalnyi's ownership, corporate hierarchy, or relationship to other entities remain limited in available documentation.

Incidents

1 incident linked to this organisation.