How threat actors are using SMB vulnerabilities

🗓️ 14 Dec 2018 16:00:00Reported by Pieter ArntzType

malwarebytes🔗 blog.malwarebytes.com👁 1383 Views

SMB vulnerabilities in Windows enable widespread malware propagation and attacks. Exploits leaked by ShadowBrokers, including EternalBlue and EternalRomance, continue to be used in sophisticated Trojan and ransomware campaigns. Unpatched systems remain at high risk.

Reporter	Title	Published	Views	Family All 92
Gitee	Exploit for CVE-2017-0143	6 Sep 202500:38	–	gitee
0day.today	Microsoft Windows - Uncredentialed SMB RCE (MS17-010) Exploit	17 Apr 201700:00	–	zdt
0day.today	Microsoft Windows - SrvOs2FeaToNt SMB Remote Code Execution (MS17-010) Exploit	10 May 201700:00	–	zdt
0day.today	Microsoft Windows MS17-010 EternalBlue SMB Remote Windows Kernel Pool Corruption Exploit	17 May 201700:00	–	zdt
0day.today	DOUBLEPULSAR - Payload Execution and Neutralization Exploit	4 Oct 201900:00	–	zdt
0day.today	SMB DOUBLEPULSAR Remote Code Execution Exploit	4 Feb 202000:00	–	zdt
Tenable Nessus	SMB Server DOUBLEPULSAR Backdoor / Implant Detection (EternalRocks)	18 Apr 201700:00	–	nessus
Tenable Nessus	Ransomware Traffic Detected (WannaCry)	15 May 201700:00	–	nessus
Tenable Nessus	MS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE) (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks) (Petya) (uncredentialed check)	20 Mar 201700:00	–	nessus
Tenable Nessus	MS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE) (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks) (Petya)	15 Mar 201700:00	–	nessus

14 Dec 2018 16:00Current

0.4Low risk

Vulners AI Score0.4

EPSS0.8985