Posted May 23, 2017 EternalRocks, a new variant of malware leveraging the previously NSA-hoarded vulnerabilities that were dropped by the Shadow Brokers, has been seen making its rounds in the wild. This one could be a bit nastier than the big WCRY/WannaCry malware that blew up recently in the way it spreads. It uses the DoublePulsar, ArchiTouch, and SMBTouch tools. "Miroslav Stampar – a member of the Croatian Government CERT and author of the sqlmap tool used to detect and exploit SQL injection vulnerabilities – detected a new worm that exploits Windows Server Message Block (SMB) vulnerabilities. He named it EternalRocks and said it uses six SMB-specific NSA tools to spread, whereas WannaCry used only two to infect hundreds of thousands of computers across the globe. " "At this point, the malware doesn’t appear to be dropping ransomware or any other payload. But it could be paving the way for a future attack. " https://nakedsecurity.sophos.com/2017/05/22/after-wannacry-eternalrocks-digs-deeper-into-the-nsas-exploit-toolbox/ https://github.com/stamparm/EternalRocks Bottom line, keep your security patches up to date and use some common sense when it comes to email attachments. Link to comment https://linustechtips.com/topic/783504-eternalrocks-malware/ Share on other sites More sharing options... Link to post Share on other sites More sharing options...
