Ransomwarecritical
More Hacking Groups Found Exploiting SMB Flaw Weeks Before WannaCry
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-0143 | Remote Code Execution in Microsoft Windows SMBv1 (EternalBlue family) | 8.8 | 93% | KEVRansomwarePoC ×5 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 117.21.191.69 | s back to a Chinese command-and-control server on port 998 (117.21.191.69) and downloads a known rootkit backdoor, which is based on |
| ipv4 | 77.72.84.11 | tbreak. The attack originates from Russia-based IP address (77.72.84.11), but that doesn't mean the hackers are Russian. Chinese Ca |
From the original article
4 min read at thehackernews.com
Since the Shadow Brokers released the zero-day software vulnerabilities and hacking tools – allegedly belonged to the NSA's elite hacking team Equation Group – several hacking groups and individual hackers have started using them in their own way.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.