4 ms·
Systems that have already been infected with the NSA DOUBLEPULSAR rootkit are more vulnerable to infection [1]. The high prevalence in China (and Russia) might
by RachelF 9y ago
Systems that have already been infected with the NSA DOUBLEPULSAR rootkit are more vulnerable to infection [1].
The high prevalence in China (and Russia) might also indicate that these systems were hacked by the NSA prior to the Microsoft March 2017 update patch and the WannaCry ransomware.
[1] http://blog.talosintelligence.com/2017/05/wannacry.html http://blog.talosintelligence.com/2017/05/wannacry.html
- ethbro 9y agoFor reference, the specific quote "WannaCry appears to primarily utilize the ETERNALBLUE modules and the DOUBLEPULSAR backdoor. The malware uses ETERNALBLUE for the initial exploitation of the SMB vulnerability. If successful it will then implant the DOUBLEPULSAR backdoor and utilize it to install the malware. If the exploit fails and the DOUBLEPULSAR backdoor is already installed the malware will still leverage this to install the ransomware payload. This is the cause of the worm-like activity that has been widely observed across the internet."