Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

5/18/2017
12:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

NSA Tools Behind WannaCry Being Used In Even Bigger Attack Campaign

Attackers have been using NSAs EternalBlue and Double Pulsar to distribute AdylKuzz cryptocurrency malware to hundreds of thousands of systems, Proofpoint says.

The WannaCry ransomware outbreak this week garnered widespread attention for its sheer global scope and audacity but another likely even bigger attack leveraging the same stolen NSA exploits has been going on unnoticed potentially since the last week of April.

Security vendor Proofpoint Tuesday said it had identified a massive campaign to install Adylkuzz, a crypto-currency mining tool, on hundreds of thousands of systems worldwide.

As with WannaCry, the threat actors behind the Adylkuzz campaign are using the NSA's leaked EternalBlue exploit to target legacy Windows systems running a vulnerable version of the Microsoft Server Message Block (SMB) protocol.

"Upon successful exploitation via EternalBlue, machines are infected with DoublePulsar," which then downloads and runs Adylkuzz from another host system, Proofpoint said in an alert.

Once installed, Adylkuzz blocks all SMB communications on the infected system, looks for and stops any previous instances of itself on the same computer and then downloads a cryptominer and mining instructions.

Adylkuzz is not ransomware. Rather it is a so-called "miner" for Monero, a cryptocurrency that is similar to, but not as widely used as, bitcoin.

Computers infected with Adylkuzz become part of a broad distributed banking network for Monero, says Kevin Epstein vice president of threat operations at Proofpoint. "It is used as part of that network, largely for maintaining accounting or bookkeeping transactions within that network, as well [as for] money supply," he says.

In compensation for the use of the computer, the network typically pays a small fee equivalent to around $205 at current exchange rates to the miner, which in this case would really be the attacker that installed Adylkuzz.

Individual laptops might only generate a few dollars on a weekly basis but the collective payout from all of the infected systems easily tops five-figures daily, Epstein says.

Because no encryption or ransom demands are involved, victims of Adylkuzz do not realize they have been compromised. Degraded PC and server performance and the loss of access to shared Windows resources are often the only indications of a compromise, Epstein says.

Several large organizations that eported experience network performance issues this week were likely victims of the AdylKuzz campaign considering the timing of the incidents and the fact that none of them reported receiving ransomware notices.

"The malware is deliberately stealthy," Epstein says. "Users will only notice their Windows machine is running slowly and that they don't have access to shared Windows resources."

Proofpoint security researchers discovered the Adylkuzz attack while investigating the WannaCry campaign. It found that the attacks are being launched from multiple virtual private servers, which are also being used to massively scan the Internet for other systems to exploit.

Available data suggests that the operators of the Adylkuzz campaign are using multiple command and control servers to manage infected systems and to download cryptominer binaries and instructions for mining, Proofpoint said.

"WannaCry is a very noisy threat. You need to know it is there in order to get you to pay the ransom," says Brian Vecci, technical evangelist at Varonis. "This is different and more dangerous. It does not want you to know it's there," he says.

What attacks like WannaCry and AdylKyzz highlight are just how bad the threat situation has become with the release of the NSA's weaponized exploits. In this case, adversaries used the NSA's EternalBlue and Double Pulsar tools to distribute ransomware and a crypto mining too. But they could use it just as easily to deliver other potentially more lethal payloads, he says.

Related stories:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11937
PUBLISHED: 2020-08-06
In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion due to a memory leak. Fixed in 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5 and 0.2.69ubuntu0.1.
CVE-2020-15114
PUBLISHED: 2020-08-06
In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting i...
CVE-2020-15136
PUBLISHED: 2020-08-06
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints func...
CVE-2020-15701
PUBLISHED: 2020-08-06
An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash. Fixed in 2.20.1-0ubuntu2.24, 2.20.9-0ubuntu7.1...
CVE-2020-15702
PUBLISHED: 2020-08-06
TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which can then be used to escalate privileges....