• Trend Micro
  • About TrendLabs Security Intelligence Blog
Search:
  • Home
  • Categories
    • Ransomware
    • Vulnerabilities
    • Exploits
    • Targeted Attacks
    • Deep Web
    • Mobile
    • Internet of Things
    • Malware
    • Bad Sites
    • Spam
    • Botnets
    • Social
    • Open source
Home   »   EternalBlue

Advanced Targeted Attack Tools Found Being Used to Distribute Cryptocurrency Miners

  • Posted on:June 13, 2019 at 5:09 am
  • Posted in:Malware
  • Author:
    Trend Micro
0

We recently came across evidence of a large-scale cybercrime activity that appears to combine targeted attack tools and regular cybercrime: The attackers distribute typical malware such as cryptocurrency miners and ransomware by making use of sophisticated tools that were previously mostly seen in targeted attacks.

Read More
Tags: cryptocurrency minerEquation GroupEternalBlueShadow Brokers

Miner Malware Spreads Beyond China, Uses Multiple Propagation Methods Including EternalBlue, Powershell Abuse

  • Posted on:April 12, 2019 at 4:56 am
  • Posted in:Botnets, Malware, Open source, Vulnerabilities
  • Author:
    Trend Micro
0

We analyzed a malicious Monero miner using multiple methods for propagation and infection to systems and vulnerable databases. While initially found infecting systems in China beginning of the year, the malware is expanding to other countries with more infiltration techniques like EternalBlue and PowerShell abuse.

Read More
Tags: cryptocurrencyEternalBlueMoneroPowershell

Cryptocurrency Miner Uses WMI and EternalBlue To Spread Filelessly

  • Posted on:August 21, 2017 at 5:47 am
  • Posted in:Exploits, Malware
  • Author:
    Trend Micro
0

Fileless malware can be a difficult threat analyze and detect. It shouldn’t be a surprise that an increasing number of new malware threats are fileless, as threat actors use this technique to make both detection and forensic investigation more difficult. We recently found a new cryptocurrency miner (which we detect as TROJ64_COINMINER.QO) that uses this particular technique as well.

Read More
Tags: cryptocurrencyEternalBlueWMI

Large-Scale Petya Ransomware Attack In Progress, Hits Europe Hard

  • Posted on:June 27, 2017 at 12:37 pm
  • Posted in:Malware, Ransomware
  • Author:
    Trend Micro
0

A large-scale ransomware attack reported to be caused by a variant of the Petya ransomware is currently hitting various users, particularly in Europe. This variant, which Trend Micro already detects as RANSOM_PETYA.SMA, is known to use both the EternalBlue exploit and the PsExec tool as infection vectors.

Read More
Tags: EternalBluepetyaransomwareWannaCry

MS17-010: EternalBlue’s Large Non-Paged Pool Overflow in SRV Driver

  • Posted on:June 2, 2017 at 1:10 am
  • Posted in:Exploits, Vulnerabilities
  • Author:
    William Gamazo Sanchez (Vulnerability Research)
0

The EternalBlue exploit took the spotlight this month as it became the tie that bound the spate of malware attacks these past few weeks—the pervasive WannaCry, the fileless ransomware UIWIX, the Server Message Block (SMB) worm EternalRocks, and the cryptocurrency mining malware Adylkuzz.

EternalBlue (patched by Microsoft via MS17-010) is a security flaw related to how a Windows SMB 1.0 (SMBv1) server handles certain requests. If successfully exploited, it can allow attackers to execute arbitrary code in the target system. The severity and complexity of EternalBlue, alongside the other exploits released by hacking group Shadow Brokers, can be considered medium to high.

We further delved into EternalBlue’s inner workings to better understand how the exploit works and provide technical insight on the exploit that wreaked havoc among organizations across various industries around the world.

Read More
Tags: EternalBlueMS17-010Server Message Block

Security Predictions for 2020

  • Cybersecurity in 2020 will be viewed through many lenses — from differing attacker motivations and cybercriminal arsenal to technological developments and global threat intelligence — only so defenders can keep up with the broad range of threats.
    Read our security predictions for 2020.

Business Process Compromise

  • Attackers are starting to invest in long-term operations that target specific processes enterprises rely on. They scout for vulnerable practices, susceptible systems and operational loopholes that they can leverage or abuse. To learn more, read our Security 101: Business Process Compromise.

Popular Posts

Sorry. No data so far.

Stay Updated

  • Home and Home Office
  • |
  • For Business
  • |
  • Security Intelligence
  • |
  • About Trend Micro
  • Asia Pacific Region (APAC): Australia / New Zealand, 中国, 日本, 대한민국, 台灣
  • Latin America Region (LAR): Brasil, México
  • North America Region (NABU): United States, Canada
  • Europe, Middle East, & Africa Region (EMEA): France, Deutschland / Österreich / Schweiz, Italia, Россия, España, United Kingdom / Ireland
  • Privacy Statement
  • Legal Policies
  • Copyright © Trend Micro Incorporated. All rights reserved.