China, Addicted to Bootleg Software, Reels from Ransomware Attack

Re:China, Addicted to Bootleg Software, Reels from Ransomwar... by RachelF on Monday May 15, 2017 @08:01PM (#14346293)

Systems that have already been infected with the NSA DOUBLEPULSAR rootkit are more vulnerable to infection [1].

The high prevalence in China (and Russia) might also indicate that these systems were hacked by the NSA prior to the Microsoft March 2017 update patch and the WannaCry ransomware.

[1] http://blog.talosintelligence.com/2017/05/wannacry.html

[ Parent | on HN ]

Re:China, Addicted to Bootleg Software, Reels from Ransomwar... by ethbro on Monday May 15, 2017 @10:38PM (#14346994)

For reference, the specific quote "WannaCry appears to primarily utilize the ETERNALBLUE modules and the DOUBLEPULSAR backdoor. The malware uses ETERNALBLUE for the initial exploitation of the SMB vulnerability. If successful it will then implant the DOUBLEPULSAR backdoor and utilize it to install the malware. If the exploit fails and the DOUBLEPULSAR backdoor is already installed the malware will still leverage this to install the ransomware payload. This is the cause of the worm-like activity that has been widely observed across the internet."

[ Parent | on HN ]