• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – CVE-2018-12882 – updates for IBM Lotus Protector for Mail Security PHP DoS Vulnerability
December 27, 2018
Rewterz Threat Alert – Financial sector hit by malicious email campaign that abuses Google Cloud Storage
December 27, 2018

Rewterz Threat Alert – WannaCry still Lurks on Infected Computers, 18 months after the initial outburst

December 27, 2018

SEVERITY: LOW

 

 

CATEGORY: INFORMATIVE UPDATES

 

 

ANALYSIS SUMMARY:

 

 

Eighteen months after the initial outburst, WannaCry ransomware still lurks on hundreds of infected computers and continues towards infecting more computers.

 

When the WannaCry was first unleashed, Kryptos Logic security researcher Marcus Hutchins registered a domain that acted as a killswitch for the ransomware component of the infection. If the infection would connect to this killswitch domain, the ransomware component would not activate. The infection however, silently runs in the background and keeps on checking the killswitch routinely to check whether the domain is still live.

 

The initial outburst of WannaCry in 2017 was just a beginning, as many security analysts predicted higher levels of attack. Here’s one of such alerts.

 

As they predicted, the espionage continues till date. The WannaCry domain is observed to be receiving 17 million
connections coming from 630 unique IP addresses from 194 different countries in a week.

 

What is WannaCry?

 

The WannaCry ransomware has multiple components. It arrives on the infected machine in form of a dropper. It’s a self contained program which extracts the other application components embedded within itself.
Those components are:

  • An application that encrypts and decrypts data
  • Files containing encryption keys
  • A copy of Tor

 

Once it is launched, WannaCry tries to access a hard coded URL (Killswitch), and if it can’t, it searches for and encrypts files in a slew of important formats ranging from MS Office to MP3s, leaving them inaccessible to the user and displays a ransom notice to the user, demanding bitcoins to decrypt the files.

 

Below is the graph showing countries that are still infected with WannaCry.

 

 

 

 

All it needs is an Internet outage to occur and for the kill switch domain to no longer be accessible for the ransomware to kick in.

 

 

REMEDIATION:

 

 

It is recommended to monitor your range of IP addresses for all known infections, including WannaCry and similar malware families.

  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.