New malware worm spreads using leaked NSA exploits

By

EternalRocks features seven spy tools.

Researchers have discovered a new worm that utilises exploits leaked from the US National Security Agency (NSA), following the destructive WannaCry ransomware outbreak.

New malware worm spreads using leaked NSA exploits

Dubbed EternalRocks, like WannaCry the worm targets vulnerable implementations of Microsoft's Server Message Block (SMB) file sharing protocol.

Penetration tester Miroslav Stampar, also a member of the Croatian government computer emergency response team, captured a sample of the worm and posted an analysis on Github. 

EternalRocks is also known as MicroBotMassiveNet and BlueDoom. It utilises seven SMB exploits: ETERNALBLUE, ETERNALCHAMPION, ETERNALROMANCE and ETERNALSYNERGY, along with DOUBLEPULSAR, ARCHITOUCH and SMBTOUCH.

EternalRocks uses a two-stage attack on target systems, starting with infecting unpatched Windows systems and downloading further malware components and a TOR browser for obfuscated communications with a command and control server.

The second stage of the attack sees EternalRocks activate after 24 hours, with the above SMB exploits downloaded and the worm scanning the internet for systems that listen on TCP port 445.

EternalRocks has no current payload like the ransomware encryption module of WannaCry, and only spreads itself among vulnerable systems.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:

Most Read Articles

Phishing attack nets enormous npm supply chain compromise

Phishing attack nets enormous npm supply chain compromise

VicRoads to phase out passwords in favour of passkeys

VicRoads to phase out passwords in favour of passkeys

Service NSW centralises security, networking in mammoth CloudOps overhaul

Service NSW centralises security, networking in mammoth CloudOps overhaul

Apple adds "mercenary spyware" protection to new A19 chip

Apple adds "mercenary spyware" protection to new A19 chip

Log In

  |  Forgot your password?