Threat Brief: WanaCrypt0r
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-0144 | Remote Code Execution in Microsoft SMBv1 (EternalBlue) affecting Windows and Siemens devices | 8.8 | 99% | KEVRansomwarePoC ×6 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com | not resolve. The initial variant of WanaCrypt0r uses hxxp://iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com, however, there are reports of newer variants using diffe |
| url | http://iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com | should not resolve. The initial variant of WanaCrypt0r uses hxxp://iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea[.]com, however, there are reports of newer variants using diffe |
From the original article
7 min read at unit42.paloaltonetworks.com
This Unit 42 blog provides an update on the threat situation surrounding the WanaCrypt0r ransomware attacks and how the attack propagates. Initial reports said that the WanaCrypt0r attack began as part of a spam/phishing campaign. Unit 42 and other researchers have concluded that these reports are not substantiated.
By Rick Howard · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.