U.S. Army machine communicated with infrastructure used to deploy WannaCry

A machine tied to an IP address associated with the U.S. Army connected to a command and control infrastructure used to send out WannaCry ransomware

Clarification: U.S. Army Cyber Command disputed CyberScoop’s earlier description of the incident, saying that the IP address supplied to CyberScoop was indicative of research, rather than a machine that had been infected. The story has been amended.

A machine tied to an IP address associated with the U.S. Army connected to a command and control infrastructure used to send out WannaCry ransomware, CyberScoop has learned based on a list of affected IP addresses provided by a security vendor.

The vendor observed this IP address, which is tied to the Army Research Laboratory, communicate with the attacker command and control server a total of seven times on May 12. The IP address is tied to a server block parked at a host located at Fort Huachuca, Arizona.

The type of machine the IP address is attached to is unknown.

Fort Huachuca is home to the Army’s Network Enterprise Technology Command (NETCOM) and Information Systems Engineering Command (USAISC).

In a Tuesday statement sent to CyberScoop, ARL public affairs officer Tom Moyer neither confirmed nor denied whether an infection had taken place: “The U.S. Army Research Laboratory takes the security of its networks very seriously and does not openly discuss the systems and methods used to ensure the integrity of its networks.”

Other IP addresses from the list supplied to CyberScoop have been independently confirmed to be affected by WannaCry. Our sister publication StateScoop reported Monday that government offices in Cook County, Illinois, were infected, making it the first known case of a local government being hit by the computer virus.

The vendor provided the data on condition of anonymity in order to discuss sensitive material.

The WannaCry campaign began on Friday, affecting upwards of 300,000 computers. The ransomware is spread by leveraging malicious computer code that was once used by the National Security Agency.

A mysterious group known as the Shadow Brokers started sharing supposed NSA hacking tools, including the tool used to spread WannaCry, through a series of blog posts starting last August.

One of the hacking tools leaked by the ShadowBrokers, codenamed ETERNALBLUE, exploits a vulnerability in older versions of Microsoft Windows. The spread of WannaCry is supported by computer code copied from ETERNALBLUE, which enables the ransomware to spread inside of vulnerable networks.

While WannaCry has disrupted operations for a significant number of organizations based in Europe, officials say it remains largely under control in the U.S.

A official with Department of Homeland Security told reporters Tuesday that less than 10 U.S. organizations reported an infection to DHS.

Government

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure