WCry ransomware explodes in massive distribution wave

The ransomware is using an NSA exploit leaked by The Shadow Brokers, and has made tens of thousands of victims worldwide, including the Russian Interior Ministry, Chinese universities, Hungarian telcos, FedEx branches, and more. 

A ransomware outbreak is wreaking havoc all over the world, but especially in Spain, where Telefonica — one of the country’s biggest telecommunications companies — has fallen victim, and its IT staff is desperately telling employees to shut down computers and VPN connections in order to limit the ransomware’s reach.

Version 1.0 of this ransomware was discovered by Malwarebytes researcher S!Ri on February 10 and then spotted in a brief campaign on March 25 by GData security researcher Karsten Hahn.

Version 2.0 was detected for the first time around four hours ago by independent security researcher MalwareHunter. The security researcher says the ransomware came out of nowhere and started spreading like wildfire.

In these first four hours, WCry 2.0 made more victims than Jaff, a ransomware spotted this week distributed via the Necurs botnet, the former home of the Locky ransomware. In numbers, in just four hours WCry made 1.5 times more victims than Jaff did all week.

Currently, researchers weren’t able to pinpoint the exact origin of the WCry distribution campaign. At the moment, it could be from malvertising, exploit kits, email spam, or hand-cranked RDP attacks.

WCry outbreak making high-profile victims in Spain

Citing data from ID-Ransomware, a service that helps users identify ransomware infections, MalwareHunter told Bleeping Computer the ransomware had made victims all over the world, in countries such as Taiwan, Russia, Turkey, Kazakhstan, Indonesia, Vietnam, Japan, Spain, Germany, Ukraine, and the Philippines.

By far, the most affected country seems to be Spain. According to Spanish newspaper El Mundo, there are hundreds of PCs infected with WCry 2.0 at Telefonica, a local ISP.

The publication has confirmed the infections, and also heard back from employees, who told the newspaper they’ve been advised to shut down their computers and not use any of the company’s internal VPNs.

Wana Decrypt0r uses NSA’s ETERNALBLUE exploit

What was clear about this ransomware was that Wana Decrypt0r was extremely virulent. The one who unraveled the mystery was French security researcher Kafeine, who was the first to spot that Wana Decrypt0r triggered security alerts for ETERNALBLUE, an alleged NSA exploit leaked online last month by a nefarious group known as The Shadow Brokers.

ETERNALBLUE works by exploiting a vulnerability in the SMBv1 protocol to get a foothold on vulnerable machines connected online. Microsoft patched the flaw in MS17-010, released in March, but that doesn’t mean all Windows PC owners have applied the security update.

Unpatched Windows machines exposed online today risk being exploited with ETERNALBLUE, and then infected with Wana Decrypt0r.

UPDATE: After this article’s publication CERT Spain and other security experts confirmed seeing the Wana Decrypt0r actors also dropping the NSA’s DOUBLEPULSAR malware on infected systems as well. This is a Windows kernel Ring-0 exploit — also developed by the NSA and leaked by the Shadow Brokers — that was used by an unknown actor in late April to infect over 36,000 computers worldwide. DOUBLEPULSAR is what’s called a “malware loader,” used to download and install other malware.

Mjolnir Security customers were automatically protected against this threat and continue to be against ongoing variants.

Recommended Actions:

• Update systems to latest version or patch as reported by Microsoft – https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
• For systems without support or patch is recommended to isolate from the network or turn off as appropriate.
• Isolate communication to ports 137 and 138 UDP and ports 139 and 445 TCP in organizations’ networks.
• Discover which systems, within your network, can be susceptible to attack through the vulnerability of Windows, in which case, can be isolated, updated and / or shut down.
• Use CCN-CERT’s tool to scan computers not infected yet – https://www.ccn-cert.cni.es/seguridad-al-dia/comunicados-ccn-cert/4491-updated-version-of-ccn-cert-s-tool-to-prevent-the-execution-of-the-ransomware-wannacry.html

These are the Indicators of Compromise that we have seen and compiled from our partners:

Reference:

• https://www.ccn-cert.cni.es/seguridad-al-dia/comunicados-ccn-cert/4491-updated-version-of-ccn-cert-s-tool-to-prevent-the-execution-of-the-ransomware-wannacry.html
• https://www.bleepingcomputer.com/news/security/wana-decrypt0r-ransomware-using-nsa-exploit-leaked-by-shadow-brokers-is-on-a-rampage/
• https://www.bleepingcomputer.com/news/security/telefonica-tells-employees-to-shut-down-computers-amid-massive-ransomware-outbreak/
• https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
• https://gist.github.com/Blevene/42bed05ecb51c1ca0edf846c0153974a
• https://ghostbin.com/paste/xgvdv
• Header image from  https://intel.malwaretech.com/botnet/wcrypt