It is now more than two years since the world was introduced to EternalBlue, Microsoft Windows exploit thought to have been developed by the National Security Agency (NSA) and subsequently leaked. That initial introduction was by way of the WannaCry ransomware attack that spread rapidly across the globe. Unfortunately, it would appear that EternalBlue exploiting malware is still alive today and kicking hard.
What is the worm infecting Windows machines?
A botnet known as Smominru has been active since 2017, targeting Windows machines using a combination of an EternalBlue exploit worm and brute-force attacks. The Threat Analysis Unit (TAU) at Carbon Black published a threat intelligence notification regarding Smominru on August 12. It reported how the primarily cryptomining campaign had evolved to include multiple new attack techniques such as LOLBins, used to such devastating effect by the recent Windows Nodersok attack, modified malware and credential theft. Smominru also deploys a variety of other payloads and backdoors, making it a highly dangerous threat to your network.
No NSA warning, but Smominru remains a global threat
While the NSA hasn't warned Windows users to update as it did with the recent BlueKeep worm exploit, Smominru has already gone global. Countries with several thousand machines compromised include Brazil, China, Russia, Taiwan and the U.S. But it's the infection rate itself that is nothing short of staggering as I will explain in a moment. Kaspersky haspublished a warning for those Windows users who have still not patched their systems against the EternalBlue exploit despite Microsoft making the fix available March 14, 2017. Windows users are advised to check this Microsoft update support guide to verify if the relevant MS17-010 update has been installed.
The staggering infection rate of this Windows worm
Why all the fuss? It's that staggering infection rate I mentioned earlier that is concerning security researchers. A recent Guardicore Labs report found that Smominru has been infecting Windows systems at a rate of 4,700 machines every day.
Once the botnet worm gets into a system, it will move laterally where possible and infect as many machines inside an organization as it can. In just one month, some 90,000 infected machines were compromised. Windows 7 and Windows Server 2008 make up the most significant slice of the Windows infection pie, some 85% of the compromised machines were running one or the other, but Windows Server 2012, Windows XP, and Windows Server 2003 users were also found to be at risk.
Windows worm mitigation advice
Perhaps most worrying of all, though, that report revealed that 25% of the compromised hosts are infected more than once, suggesting that the victims are not fixing the root cause of the susceptibility: vulnerability to EternalBlue. Of course, because the operating systems most at risk are those which have been out of support for some time, or are reaching end of life status, the unpatched status of these machines is perhaps understandable. However, users are urged to check still as Microsoft made these updates available for systems that would ordinarily be out of support, such was the seriousness of the threat.
As Smominru also relies upon weak passwords to brute force access to systems, a password audit is recommended tom ensure suitably strong passwords are being used. Where systems cannot be aligned with current software updates, users are advised to ensure additional mitigation measures are in place, such as real-time threat detection of internet traffic flows and network micro-segmentation where possible.
Posting comments after three months has been disabled.