Necro Python bot now enhanced with new VMWare, server exploits

CVE-2017-0144 is a remote code execution flaw in the SMBv1 server component of Microsoft Windows, commonly known as EternalBlue, and one of the SMB flaws fixed by Microsoft in the March 2017 MS17-010 bulletin. An attacker who can reach the SMB service over the network sends specially crafted packets that trigger memory corruption in the SMBv1 implementation, gaining the ability to execute arbitrary code on the target without user interaction. Successful exploitation yields full system compromise and has been heavily weaponized for wormable spread and ransomware delivery, notably via the leaked NSA exploit and in the WannaCry/NotPetya-era outbreaks, and the flaw has repeatedly been bundled into botnets and ransomware tooling since. Anyone running unpatched Windows Vista SP2 through Windows 10 1607 / Windows Server 2016 with SMBv1 enabled is affected, as are Siemens medical and laboratory devices (ACUSON ultrasound, syngo SC2000, Tissue Preparation System, VERSANT kPCR systems) whose firmware depends on SMBv1. Exploitation is actively ongoing: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10) with known ransomware use, carries a 99.2% EPSS exploitation probability (100th percentile), and multiple public exploits and PoCs are available.

Do: Apply the Microsoft MS17-010 (March 2017) security updates on every listed Windows version and the corresponding Siemens firmware updates for ACUSON, syngo SC2000, Tissue Preparation System, and VERSANT kPCR devices, per CISA's required action to apply vendor updates. Where patching is not yet possible, disable SMBv1 or block inbound TCP 445 (and UDP 137/138) at network boundaries and isolate legacy/medical systems from the internet. Sweep exposed and legacy hosts for compromise indicators, including DOUBLEPULSAR implants delivered over SMB, as public tooling for detecting and neutralizing this implant is available.

CVE-2017-0147 is an information disclosure flaw in the SMBv1 server component of Windows: an unauthenticated remote attacker sends specially crafted SMBv1 packets that cause the server to leak sensitive contents of process memory. It belongs to the SMBv1 'Eternal' family of flaws patched in Microsoft's March 2017 MS17-010 bulletin, whose exploit tooling later surfaced in the Shadow Brokers leak and is associated with DOUBLEPULSAR implant activity on TCP 445. The attacker gains read access to process memory (confidentiality-only impact reflected in the CVSS 7.5 score), which can expose sensitive data or assist follow-on attacks, though this CVE alone does not grant code execution. Anyone running the affected Windows releases with the SMBv1 server enabled is exposed, including legacy desktops and servers and Siemens ACUSON P300/P500 ultrasound systems, particularly hosts with TCP 445 reachable from untrusted networks. Exploitation is in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-05-24 with known ransomware use, and EPSS assigns a ~99.7% probability of exploitation activity in any 30-day window.

Do: Apply Microsoft's MS17-010 security update (March 2017) or later cumulative updates on every affected Windows host, per the vendor's instructions, and update Siemens ACUSON P300/P500 firmware per Siemens' guidance. Where patching is impractical, disable SMBv1 (e.g., via Group Policy or Set-SmbServerConfiguration -EnableSMB1Protocol $false) and restrict inbound TCP 445 to trusted networks only. Audit exposed and legacy hosts for DOUBLEPULSAR-style SMB implants and unnecessary SMBv1 exposure.