Eternalblue

Vulnerability updated a month ago (2024-09-11T19:18:36.692Z)

Download STIX

Preview STIX

EternalBlue is a software vulnerability, specifically a flaw in the design or implementation of certain versions of Microsoft's Windows operating system. This vulnerability, formally known as CVE-2017-0144, allows malicious actors to execute code on the target server or system without proper authorization. EternalBlue gained significant notoriety for its role in enabling the widespread WannaCry ransomware attack, which resulted in extensive damage and disruption across multiple sectors worldwide. During a recent cybersecurity assessment conducted by the CISA team, several unpatched systems were identified, including instances of both EternalBlue and another vulnerability known as BlueKeep (CVE-2019-0708). The team attempted to exploit these vulnerabilities to compromise the systems under assessment. While they were unsuccessful with BlueKeep, they managed to exploit EternalBlue on a server, subsequently establishing a shell with local SYSTEM privileges. This successful exploitation underscores the ongoing risk posed by EternalBlue, particularly in systems that have not been properly patched or updated. The existence of other exploits sharing naming conventions with EternalBlue, such as EternalRomance, suggests a broader family of related vulnerabilities. These vulnerabilities, if left unaddressed, could potentially be exploited in similar ways, leading to unauthorized access, data breaches, or other forms of cyberattacks. Therefore, it is crucial for organizations to maintain up-to-date patching practices and robust cybersecurity defenses to protect against such threats.

Description last updated: 2024-09-11T19:17:12.205Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
CVE-2017-0144 is a possible alias for Eternalblue.	5
Ms17-010 is a possible alias for Eternalblue. MS17-010, also known as EternalBlue, EternalSynergy, or EternalRomance, is a significant remote code execution vulnerability in Microsoft's Server Message Block 1.0 (SMBv1) protocol. This flaw in software design and implementation was exploited by various malware strains, most notably the WannaCry r	5
T1210 is a possible alias for Eternalblue.	2
Stripedfly is a possible alias for Eternalblue. StripedFly is a malicious threat actor that has been active since at least April 9, 2016, as indicated by the earliest known version of StripedFly incorporating the EternalBlue exploit. The authors behind StripedFly show parallels with the EternalBlue exploit, which is notorious for its use in wides	2

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Exploit

Windows

Vulnerability

Exploits

Malware

Worm

Ransomware

Lateral Move...

Apt

Remote Code ...

Backdoor

Dropper

T1210

RCE (Remote ...

Payload

Reconnaissance

Botnet

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The WannaCry Malware is associated with Eternalblue. WannaCry, a potent malware, emerged as one of the most destructive cyberattacks in recent history when it struck in May 2017. Leveraging Windows SMBv1 Remote Code Execution vulnerabilities (CVE-2017-0144, CVE-2017-0145, and CVE-2017-0143), WannaCry rapidly spread across systems worldwide, encrypting	Exploited	8
The NotPetya Malware is associated with Eternalblue. NotPetya is a malicious software (malware) that caused extensive damage worldwide in 2017. It was initially perceived as ransomware, similar to other notorious variants such as WannaCry, Petya, TeslaCrypt, DarkSide, and REvil. However, unlike typical ransomware, NotPetya was primarily destructive ra	Exploited	3
The Lucifer Malware is associated with Eternalblue. Lucifer is a powerful and relatively new malware variant that combines cryptojacking and DDoS (Distributed Denial of Service) attack capabilities. This malicious software targets Windows platforms, exploiting older vulnerabilities to spread and perform harmful activities. Lucifer is particularly not	Unspecified	2
The petya Malware is associated with Eternalblue. Petya is a type of malware, specifically ransomware, that infected Windows-based systems primarily through phishing emails. It was notorious for its ability to disrupt operations and hold data hostage for ransom. Petya, along with other types of ransomware like WannaCry, NotPetya, TeslaCrypt, and Da	Exploited	2

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The Shadow Brokers Threat Actor is associated with Eternalblue. The Shadow Brokers, a threat actor group, has been involved in several high-profile cybersecurity incidents. They first came into the limelight in August 2016 when they leaked tools believed to be from the Equation Group, an Advanced Persistent Threat (APT) group associated with the U.S. National Se	Unspecified	5
The Equation Group Threat Actor is associated with Eternalblue. The Equation Group is a threat actor, believed to have ties to the United States, that has been involved in numerous cyber espionage operations. The group's favorite vulnerabilities include CVE-2017-0144, a Windows server message block code execution vulnerability that was leaked by another group kn	Unspecified	3
The Expetr Threat Actor is associated with Eternalblue. ExPetr, also known as PetrWrap, Petya, or NotPetya, is a threat actor that emerged in the cybersecurity landscape on April 15, 2017, with its first ransomware attack infused with EternalBlue. The code used by ExPetr was borrowed from another malicious software called Win32/Diskcoder.Petya ransomware	Unspecified	2
The Wannacryptor Threat Actor is associated with Eternalblue. WannaCryptor, also known as WannaCry or Wanna Decryptor, is a threat actor that has been active since at least 2009. This group, which is aligned with North Korea, has been responsible for several high-profile cyber incidents. Notable among these are the Sony Pictures Entertainment hack in 2014, cyb	Unspecified	2

Associated Vulnerabilities

To see the evidence that has resulted in these vulnerability associations, create a free account

Alias Description	Association Type	Votes
The Eternalromance Vulnerability is associated with Eternalblue. EternalRomance is a software vulnerability, specifically an exploit for the Server Message Block version 1 (SMBv1) protocol, which was leaked by the group known as the "ShadowBrokers." It affects Windows XP, Windows Server 2003, and Windows Vista systems. This flaw allows attackers to execute arbitr	Unspecified	3

Source Document References

Information about the Eternalblue Vulnerability was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
BankInfoSecurity	a month ago	NoName Apparently Allies With RansomHub Operation
ESET	a month ago	CosmicBeetle steps up: Probation period at RansomHub
Securityaffairs	2 months ago	SECURITY AFFAIRS MALWARE NEWSLETTER – ROUND 6
Securityaffairs	2 months ago	security-affairs-malware-newsletter-round-5
Securityaffairs	3 months ago	Security Affairs Malware Newsletter - Round 3
Securityaffairs	3 months ago	Security Affairs Malware Newsletter - Round 3
Securityaffairs	3 months ago	Security Affairs Malware Newsletter - Round 2
Securityaffairs	3 months ago	Security Affairs Malware Newsletter - Round 1
Securityaffairs	3 months ago	Security Affairs newsletter Round 478 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs	3 months ago	Security Affairs newsletter Round 477 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs	4 months ago	Security Affairs newsletter Round 476 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs	4 months ago	Security Affairs newsletter Round 473 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs	5 months ago	Security Affairs newsletter Round 470 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs	5 months ago	Security Affairs newsletter Round 469 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs	6 months ago	Security Affairs newsletter Round 467 by Pierluigi Paganini – INTERNATIONAL EDITION
Securityaffairs	6 months ago	Security Affairs newsletter Round 466 by Pierluigi Paganini
Securityaffairs	6 months ago	Security Affairs newsletter Round 465 by Pierluigi Paganini
Securityaffairs	6 months ago	Security Affairs newsletter Round 464 by Pierluigi Paganini
Securityaffairs	7 months ago	Security Affairs newsletter Round 463 by Pierluigi Paganini
Securityaffairs	7 months ago	Security Affairs newsletter Round 462 by Pierluigi Paganini