Cisco Coverage for Adylkuzz, Uiwix, and Eternal Rocks
Summary: Cisco Talos reported that Adylkuzz, Uiwix, and EternalRocks are malware variants using the ETERNALBLUE and DOUBLEPULSAR exploits from the Shadow Brokers release, following the WannaCry attack. Adylkuzz installs cryptocurrency mining software and pre-dates WannaCry, Uiwix installs ransomware without worming itself, and EternalRocks uses the access as a backdoor with a 24-hour sleep before downloading a final payload containing multiple Shadow Brokers exploits.
Why it matters: These attacks exploit vulnerabilities covered by MS17-010 that have been known for at least two months, and EternalRocks' 24-hour delay before payload delivery is designed to evade sandbox environments - meaning detection windows you rely on may already be too short.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2017-0143
- Related
- CVE-2017-0143: Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026