WannaCryptor wasn’t the first to use EternalBlue: Miners misused it days after Shadow Brokers leak

itman · May 17, 2017

The massive campaign that spread the WannaCryptor (aka WannaCry) ransomware wasn’t the only large-scale infection misusing the EternalBlue and DoublePulsar exploits, leaked by Shadow Brokers.

The same mechanism has been misused by black hats as early as the end of April, when they opted for off-the-shelf Monero cryptocurrency mining software instead of the encrypting payload.

This campaign, detected as Win32/CoinMiner.AFR and Win32/CoinMiner.AFU, started only a few days after the NSA tools leaked online. ESET had network detections for the vulnerability deployed on April 25th – only three days before the first attack attempts by these miners.

The biggest uptick has been recorded only hours before the worldwide ransomware outbreak, on May 10th. On this day, mining malware detections increased from hundreds to thousands of detections per day. We have seen such attempts in as many as 118 countries, with Russia, Taiwan and Ukraine topping the list.

However, the mining software consumed system resources so intensely that in some cases it rendered the infected machines unresponsive.

The miner attacks also blocked the 445 port used by the EternalBlue exploit to get into the machine, basically closing the door for any future infection using the same vector – including WannaCryptor. If the miners didn’t take this precaution, the number of WannaCryptor infections could have been even greater than reported.
Click to expand...

https://www.welivesecurity.com/2017/05/17/wannacryptor-wasnt-the-first-to-use-eternalblue/

Log in or Sign up

WannaCryptor wasn’t the first to use EternalBlue: Miners misused it days after Shadow Brokers leak

itman Registered Member

Log in or Sign up

WannaCryptor wasn’t the first to use EternalBlue: Miners misused it days after Shadow Brokers leak

itman Registered Member

Useful Searches