The leaked NSA hacking tools keep showing up in criminal schemes

In practice, EternalBlue will allow a hacker to quickly compromise multiple computers on a shared network as long as they are all similarly running dated Microsoft software.

A hacking tool linked to the NSA continues to be used by cybercriminals in efforts to remotely steal money and confidential information from online banking users, according to research conducted by U.S. cybersecurity firm Proofpoint.

In a recent blogpost by company researchers, Proofpoint said it had discovered two different banking trojans in the wild with computer code taken from a now publicly available exploit known as “EternalBlue,” or CVE-2017-0144.

EternalBlue is believed to have been used by the NSA to gather intelligence. Originally leaked in April, the exploit works by targeting a dated vulnerability in Microsoft’s Server Message Block protocol. The vulnerability affects outdated versions of several different Microsoft operating systems.

Microsoft already released a patch to fix the issue.

In practice, EternalBlue will allow a hacker to quickly compromise multiple computers on a shared network as long as they are all similarly running dated software.

“Patching Windows can take a very long for many organizations – we routinely observe one or two-year-old (and sometimes older) exploits being used successfully in a variety of attacks,” explained Kevin Epstein, vice president of Threat Operations for Proofpoint. “As long as threat actors continue to find widespread, unpatched vulnerabilities, they will continue to leverage exploits like EternalBlue.”

The two trojans, Retefe and TrickBot, are relatively common and have been in use for several months as part of various email phishing campaigns against companies and individual users. The latest versions of these trojans are the ones that carry elements of EternalBlue.

The new variant of Retefe identified by Proofpoint was sent in an unsolicited email to a company. The email contained a malicious Microsoft Office document that was laden with embedded Package Shell Objects. When opened, a PowerShell command will launch a download for a .zip archive holding a obfuscated JavaScript installer hosted on a remote server. The eventual result is the installation of a virus that leverages EternalBlue to quickly spread inside an infected network.

Retefe has been largely used in attacks against banks in Austria, Sweden, Switzerland, Japan and the United Kingdom, according to researchers.

“While it has never reached the scale or notoriety of better-known banking Trojans such as Dridex or Zeus, [Retefe] is notable for its consistent regional focus, and interesting implementation,” a Proofpoint blog post notes.

More broadly, the use of EternalBlue in attacks doesn’t appear to be narrowly focused or aimed at one specific industry or region, experts say.

“There does not appear to be a common theme in terms of targeting for attacks leveraging EternalBlue,” said Epstein. “Rather, this approach seems to be evolving, giving attackers both destructive and disruptive potential as we saw with WannaCry’s rapid propagation via EternalBlue as well as more precise lateral movement after a successful infiltration through other vectors as we observed with Retefe.”

In the past, the EternalBlue exploits has been used tandem with ransomware to extort money from businesses. It’s not entirely clear who is behind Retefe or Trickbot, although a relatively small group is thought to be behind the spread of Retefe.

“Although this Retefe variant appears to be used exclusively by the so-called Retefe Gang, we don’t know who first developed the malware,” Epstein told CyberScoop. “We do not have sufficient information to attribute the Trickbot variant featuring EternalBlue to a particular author.”

The EternalBlue exploit first became publicly known and adoptable following the publication of a package of NSA documents by a group known as The Shadow Brokers.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure