Indexsinas SMB Worm Campaign Infests Whole Enterprises

guest · Jul 1, 2021

Indexsinas SMB Worm Campaign Infests Whole Enterprises
June 30, 2021
https://threatpost.com/indexsinas-smb-worm-enterprises/167455/

The Indexsinas SMB worm is on the hunt for vulnerable environments to self-propagate into, researchers warned – with a particular focus on the healthcare, hospitality, education and telecommunications sectors. Its end goal is to drop cryptominers on compromised machines.

Indexsinas, aka NSABuffMiner, has been lurking since 2019. It makes use of the old Equation Group weapons arsenal, including the infamous EternalBlue and EternalRomance exploits for invading Windows SMB shares, as well as the DoublePulsar backdoor. Indexsinas’ hallmark is making aggressive use of lateral movement to fully consume targeted environments. Lately, the activity has resurged.

“Propagation is achieved through the combination of an open-source port scanner and three Equation Group exploits – EternalBlue, DoublePulsar and EternalRomance,” according to a Guardicore Labs analysis published Wednesday. “These exploits are used to breach new victim machines, obtain privileged access and install backdoors.”
Click to expand...

Guardicore: SMB Worm “Indexsinas” Uses Lateral Movement to Infect Whole Networks

Executive Summary

Guardicore reveals new details in the Indexsinas SMB worm, also dubbed NSABuffMiner.

The attack campaign has been active since 2019 and is still under operation and maintenance today.

Targeted devices are SMB servers vulnerable to EternalBlue (MS17-010). According to Shodan, there are more than 1.2 million internet-facing SMB servers today.

The attack makes vast use of the Equation Group exploit kit, which includes EternalBlue exploit as well as the DoublePulsar backdoor.

Victims include organizations in the healthcare, hospitality, education and telecommunications sectors.

Guardicore Labs published a Github repository with all IOCs for this campaign as well as a detection tool in Powershell.
Click to expand...

Log in or Sign up

Indexsinas SMB Worm Campaign Infests Whole Enterprises

guest Guest

Log in or Sign up

Indexsinas SMB Worm Campaign Infests Whole Enterprises

guest Guest

Useful Searches