Shadow Brokers leaks CONTAINS EternalBlue
One Shadow Brokers dump contained the EternalBlue exploit.
Explicit Confidence 99% · Jack Rhysider EP 53 Details
“This dump contained EternalBlue and EternalRomance, among others”
Exploit
exploit:eternalblue
Exploit released by the Shadow Brokers for remotely accessing Windows computers through SMB.
Exploit released by the Shadow Brokers for remotely accessing Windows computers through SMB.
“This dump contained EternalBlue and EternalRomance, among others.”
“EternalBlue was huge. This was the biggest of all their exploits”
An exploit for a Windows SMB vulnerability that enabled remote code execution on vulnerable systems.
“another tool was added to this worm, something called EternalBlue.”
“EternalBlue could basically run code remotely on any Windows machine that was vulnerable”
Exploit described as an NSA tool leaked by the Shadow Brokers and later associated with the WannaCry worm.
“the EternalBlue exploit was discovered”
Exploit used by WannaCry to abuse vulnerable Windows file sharing and spread remotely.
“The exploit this malware was using was EternalBlue.”
Exploit described as being developed by the NSA and used in WannaCry.
“the exploit, which they called EternalBlue”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | AFFECTS | SMB | Explicit | 53 |
| outgoing | AFFECTS | SMB | Explicit | 73 |
| outgoing | EXPLOITS | SMB vulnerability | Explicit | 54 |
| outgoing | EXPLOITS | SMB vulnerability | Explicit | 73 |
| outgoing | EXPLOITS | MS17-010 | Explicit | 57 |
| outgoing | ASSOCIATED_WITH | Shadow Brokers | Explicit | 57 |
| outgoing | ASSOCIATED_WITH | National Security Agency | Attributed | 57 |
| outgoing | DEVELOPED_BY | National Security Agency | Uncertain | 158 |
| outgoing | DEVELOPED_BY | NSA | Explicit | 73 |
| outgoing | EXPLOITS | Windows vulnerability | Explicit | 158 |
| outgoing | AFFECTS | Windows | Explicit | 158 |
| incoming | CONTAINS | Shadow Brokers leaks | Explicit | 53 |
| incoming | USES | NotPetya | Explicit | 54 |
| incoming | USES | NotPetya | Explicit | 73 |
| incoming | INVOLVES | NotPetya | Explicit | 54 |
| incoming | USES | WannaCry | Explicit | 57 |
| incoming | USES | WannaCry | Explicit | 73 |
| incoming | USES | WannaCry | Derived | 158 |
Shadow Brokers leaks CONTAINS EternalBlue
One Shadow Brokers dump contained the EternalBlue exploit.
Explicit Confidence 99% · Jack Rhysider EP 53 Details
“This dump contained EternalBlue and EternalRomance, among others”
EternalBlue AFFECTS SMB
EternalBlue is described as remotely accessing Windows computers running SMB.
Explicit Confidence 96% · Jack Rhysider EP 53 Details
“an exploit that can be used to remotely access Windows computers running SMB”
NotPetya USES EternalBlue
The worm used EternalBlue as an additional way to enter unpatched computers.
Explicit Confidence 98% · Jack Rhysider EP 54 Details
“another tool was added to this worm, something called EternalBlue”
EternalBlue EXPLOITS SMB vulnerability
EternalBlue exploited a vulnerability in the Server Message Block function.
Explicit Confidence 99% · Andy Greenberg EP 54 Details
“EternalBlue which exploited a vulnerability in a Windows function called Server Message Block”
NotPetya INVOLVES EternalBlue
The episode describes EternalBlue being used by the NotPetya worm to spread to computers without stolen passwords.
Explicit Confidence 99% · Jack Rhysider EP 54 Details
“if it couldn’t login like that, it would then try to use EternalBlue to see if that system was unpatched and exploit it that way”
EternalBlue EXPLOITS MS17-010
EternalBlue was associated with a patch identified as MS17-010; the episode describes MS17-010 as the patch produced for EternalBlue.
Explicit Confidence 98% · John Lambert EP 57 Details
“A patch was produced for it; that was MS17-010”
WannaCry USES EternalBlue
WannaCry used EternalBlue in a similar worm-like spreading pattern against systems that had not patched.
Explicit Confidence 95% · John Lambert EP 57 Details
“A couple months later, the WannaCry worm was unleashed and spread in a very similar way”
EternalBlue ASSOCIATED_WITH Shadow Brokers
The Shadow Brokers group leaked the EternalBlue exploit onto the internet.
Explicit Confidence 99% · John Lambert EP 57 Details
“This is one of these NSA tools that the Shadow Brokers group leaked onto the internet”
EternalBlue ASSOCIATED_WITH National Security Agency
EternalBlue is described as an NSA tool; the episode attributes that characterization to John Lambert's account.
Attributed Confidence 94% · John Lambert EP 57 Details
“This is one of these NSA tools”
WannaCry USES EternalBlue
WannaCry used the EternalBlue exploit.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“The exploit this malware was using was EternalBlue”
EternalBlue EXPLOITS SMB vulnerability
EternalBlue exploited a serious vulnerability in the way Windows file sharing through SMB works.
Explicit Confidence 99% · Jack Rhysider EP 73 Details
“It was a very serious vulnerability which exploited the way Windows file sharing works, or SMB”
EternalBlue AFFECTS SMB
The exploit affected SMB, the Windows file-sharing protocol.
Explicit Confidence 98% · Jack Rhysider EP 73 Details
“the way Windows file sharing works, or SMB”
EternalBlue DEVELOPED_BY NSA
Jack states that EternalBlue was created by the NSA, though the episode presents this as part of a chain of events rather than independently documented evidence.
Explicit Confidence 86% · Jack Rhysider EP 73 Details
“Shadow Brokers wouldn’t have released EternalBlue if it wasn’t for the NSA creating it to begin with”
NotPetya USES EternalBlue
The episode says NotPetya also used EternalBlue.
Explicit Confidence 98% · Jack Rhysider EP 73 Details
“in June, is when NotPetya hit Ukraine which also used EternalBlue”
EternalBlue DEVELOPED_BY National Security Agency
Jack says it was believed that the NSA developed the EternalBlue exploit.
Uncertain Confidence 84% · Jack Rhysider EP 158 Details
“We believe it was the NSA that developed the exploit, which they called EternalBlue.”
EternalBlue EXPLOITS Windows vulnerability
EternalBlue is described as an exploit for a serious vulnerability in Microsoft Windows.
Explicit Confidence 98% · Jack Rhysider EP 158 Details
“the NSA found this exploit in Windows, Microsoft Windows”
“they have this really bad vulnerability in Windows”
EternalBlue AFFECTS Windows
The EternalBlue exploit is described as affecting Microsoft Windows.
Explicit Confidence 98% · Jack Rhysider EP 158 Details
“the NSA found this exploit in Windows, Microsoft Windows”
WannaCry USES EternalBlue
The episode describes North Korea picking up the leaked EternalBlue exploit and making ransomware with it; the link between WannaCry and EternalBlue is presented in that account.
Derived Confidence 94% · Malwaretech EP 158 Details
“North Korea pick it up and decide to make ransomware with it”