Chinese and Russian Communities Analyze Shadow Brokers Malware Release
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-0143 | Remote Code Execution in Microsoft Windows SMBv1 (EternalBlue family) CVE-2017-0143 is a remote code execution flaw in the SMBv1 server implementation shipped with a wide range of Windows releases; it is one of the March 2017 'MS17-010' SMBv1 bugs (an EternalBlue-family flaw) and is distinct from CVE-2017-0144, -0145, -0146 and -0148. An attacker triggers it by sending specially crafted packets to a target's SMBv1 service over the network, gaining the ability to execute arbitrary code on the host. Because SMB is commonly reachable inside enterprise networks (and sometimes from the internet), exploitation has enabled wormable spread, ransomware (WannaCry), coin miners (Adylkuzz), and DOUBLEPULSAR backdoor implants. Anyone running unpatched, SMBv1-enabled systems from the affected list is exposed: Windows from Vista/Server 2008 through Windows 10 1607 and Server 2016, plus third-party products embedding Windows, including Philips IntelliSpace Portal and Siemens ACUSON/syngo/Versant medical systems. Exploitation is heavily confirmed in the wild: the Buckeye group used the tools before the Shadow Brokers leak, followed by mass exploitation by WannaCry, Adylkuzz, Uiwix and EternalRocks; the flaw is in CISA's KEV (added 2021-11-03, ransomware use known) and EPSS is 93.3%. Do: Apply Microsoft's MS17-010 security updates (March 2017 cumulative updates or later) to all listed Windows versions, per the CISA KEV required action. Disable SMBv1 where feasible, block or restrict inbound TCP 445 from untrusted networks, and check exposed hosts for DOUBLEPULSAR implants; public Metasploit modules (EternalBlue/EternalRomance/EternalSynergy/EternalChampion) can be used to verify exploitability. For Philips IntelliSpace Portal and Siemens ACUSON/syngo/Versant medical systems, apply the vendors' MS17-010 firmware/advisory updates. | 8.8 | 93% | KEV ransomware PoC ×5 |
| masshundreds of millions of Windows installations potentially affected (SMBv1 enabled by default), with hundreds of thousands of hosts exposing SMB/port 445… |
Full article402 words · extracted from recordedfuture.com · click to collapse
As of April 15, the Chinese cyber community had begun to investigate the most recent release of malware from the Shadow Brokers group. Security researchers and cyber actors reversed several of the tools and were particularly interested in the exploit framework (named FUZZBUNCH), the SMB malware (ETERNALBLUE), and the privilege escalation tool (ETERNALROMANCE).
Chinese-speaking actors additionally focused on the unique malware trigger point and some claimed that the patches for CVE-2017-0143 through -0148 were insufficient because they did not address the base code weaknesses.
Mentions of one of the tools, ETERNALBLUE, on the Chinese language web over time.
Mentions of Shadow Brokers-released malware on the Chinese language web and from Recorded Future sources.
The surprising recent release has also stirred up great interest among Russian-speaking cyber criminals. Only three days after the data was leaked, a well-respected member of the top-tier dark-web community provided a detailed setup tutorial of weaponizing the ETERNALBLUE exploit as well as the DOUBLEPULSAR kernel payload.
Mentions of one of the tools, ETERNALBLUE and DOUBLEPULSAR, on the Russian language web over time.
In a separate thread, another member of the community, solicited help from other members in utilizing a proper exploit for a vulnerable Server Message Block version 1 (SMBv1), identified at the time of scanning a victim's environment. Several members recommended using the recently released ETERNALBLUE exploit and admired its usefulness.
Background
Shadow Brokers is probably a hacker group that first came to public awareness in August 2016. While membership of the Shadow Brokers group remains unknown, it has both advertised for sale and publicly released hacker tools and exploits which the group claims were written and used by the U.S. National Security Agency (NSA).
Impact
Discussions in the Chinese and Russian cyber communities indicate that there is broad interest in these capabilities released by Shadow Brokers. Chinese users are particularly interested in the unique malware triggers and many feel the underlying vulnerability exploited by these toolsets has not been completely mitigated by the patches.
Further, Chinese APT groups have demonstrated an ability to quickly weaponize zero-day vulnerabilities, in as little as three days after public release in one instance.These three factors combine to increase the risk that malicious Chinese actors may reuse or repurpose this malware.
Recorded Future customers should set up alerts on these tools and the corresponding vulnerabilities, patch critical systems immediately, and remain vigilant to unique variations on these exploitation techniques.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.recordedfuture.com/blog/shadow-brokers-malware-release