Threat Brief: Wana Crypt0r– What We Know
Summary: WanaCrypt0r emerged on Friday, May 12, 2017, as a global ransomware attack that spreads by exploiting the ETERNALBLUE vulnerability (CVE-2017-0144) in Microsoft Windows SMB, a flaw patched in March 2017 via MS17-010 and, for out-of-support versions like Windows XP, Windows 8 and Windows Server 2003, through an emergency Microsoft patch released the same day. Unit 42 found no substantiation for early reports of a spam or phishing initial vector, and its analysis of attacker Bitcoin addresses totaled 36 BTC, roughly $63k, implying about 210 victims paid the $300 ransom.
Why it matters: A wormable SMB exploit paired with ransomware spread across internal networks and the open internet by scanning TCP port 445, so a single unpatched host was enough to propagate the attack - and Unit 42 is not aware of any case where paying the ransom recovered data.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-0144
- Related
- CVE-2017-0144: Microsoft SMBv1 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Feb 10, 2022