Next NSA Exploit Payload Could be Much Worse Than WannaCry

[RV_]

There is a brief expected break as the folks who did the recent Wanna Cry successful exploits against hundreds of thousands of computers that should have been upgraded three years ago when support was dropped for XP machines. Or in the case of newer currently supported Windows versions 7, 8.1 or 10, they neglected their Windows updates from March 2017 on, when it was patched, to today.

Excerpt:

"No one should be letting their guard down now that the WannaCry ransomware attacks have been relatively contained. Experts intimately involved with analyzing the malware and worldwide attacks urge quite the opposite, warning today that there’s nothing stopping attackers from using the available NSA exploits to drop more destructive malware.

The key is to patch vulnerable Windows machines while there is a downtime, ensure offline backups are secure and available, and that antimalware protection is running and current.

Kaspersky Lab researcher Juan Andres Guerrero-Saade and Comae Technologies’ Matt Suiche said today during a webinar, below, that the EternalBlue exploit targeting a SMBv1 flaw could be fitted with payloads ranging from banking Trojans to wiper malware that destroys a computer’s hard disk.

“Absolutely,” Guerrero-Saade said when asked if this could have been a wiper attack rather than ransomware. “We’re talking ring0 access (via the DoublePulsar rootkit installed by the EternalBlue exploit). It would have just come down to a matter of implementation at that point.”

Accelerating the researchers’ anxiety about what could be next was yesterday’s ShadowBrokers announcement that it would begin in June a monthly dump of new exploits—including Windows 10 attacks—and stolen data. The ShadowBrokers’ leak in April of EternalBlue and other Windows attacks handed attackers not only the exploits but also documentation that lowered any barrier to entry for using these attacks.

“This is really worrying because we’ve seen the impact of what those files out in the wild can do,” Suiche said."

Much more and an optional video with live links here:

https://threatpost.com/next-nsa-exploit-payload-could-be-much-worse-than-wannacry/125743/