Report: No ‘Eternal Blue’ Exploit Found in Baltimore City Ransomware
Summary: Analysis by malware analyst Joe Stewart, consulting with Armor, found that the Robbinhood ransomware sample tied to Baltimore's attack contained no Eternal Blue exploit code and was a "pretty vanilla ransomware binary" with no means of spreading across networks on its own. The New York Times had cited unnamed experts blaming Eternal Blue for the spread, prompting an NSA denial, while the @Robihkjn Twitter account taunted Baltimore's mayor and council over the unpaid 13 bitcoin (about $100,000) demand until it was suspended on June 3, 2019.
Bottom line: The attackers set a payment deadline of June 7, 2019 and posted links to documents allegedly stolen from city systems, so the exposure extends beyond encrypted files to data already in the intruders' hands.
Read the original at Krebs on Security ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026