Hacking tools were stolen from NSA - Almost all Windows affected

Interesting tidbit about WCry:

One thing from Malwarebytes update at The worm that spreads WanaCrypt0r - Malwarebytes Labs | Malwarebytes Labs

UPDATE: The second argument to InternetOpenA is 1 (INTERNET_OPEN_TYPE_DIRECT), so the worm will still work on any system that requires a proxy to access the Internet, which is the case on the majority of corporate networks. Thanks to Didier Stevens for spotting what was missed by most.

The accidental kill-switch will not protect those who are running through a proxy server, nor the variants that have the link to the backdoor website removed

Fafhrd said:

One thing from Malwarebytes update at The worm that spreads WanaCrypt0r - Malwarebytes Labs | Malwarebytes Labs



The accidental kill-switch will not protect those who are running through a proxy server, nor the variants that have the link to the backdoor website removed

Danger from this attack is far from over. We'll see variants in the next weeks at least.

Interesting article on Ars Technica | massive-cryptocurrency-botnet-used-leaked-nsa-exploits-weeks-before-wcry

Like WannaCry, this earlier, previously unknown attack used an exploit codenamed EternalBlue and a backdoor called DoublePulsar, both of which were NSA-developed hacking tools leaked in mid April by a group calling itself Shadow Brokers. But instead of installing ransomware, the campaign pushed cryptocurrency mining software known as Adylkuzz. WannaCry, which gets its name from a password hard-coded into the exploit, is also known as WCry.

AndreTen said:

You're right there. I've connected this two statements without carefully reading articles. But then who read this stuff carefully?

not me anyway. Lets face it 99% of the 'news' on the net is faked anyway.

Fafhrd said:

One thing from Malwarebytes update at The worm that spreads WanaCrypt0r - Malwarebytes Labs | Malwarebytes Labs

UPDATE: The second argument to InternetOpenA is 1 (INTERNET_OPEN_TYPE_DIRECT), so the worm will still work on any system that requires a proxy to access the Internet, which is the case on the majority of corporate networks. Thanks to Didier Stevens for spotting what was missed by most.

The accidental kill-switch will not protect those who are running through a proxy server, nor the variants that have the link to the backdoor website removed

Hopefully everyone is patched/getting patched by now. (Although I have 1 Vista laptop that hasn't been able to download updates since last year, so it's a problem.)

AndreTen said:

Danger from this attack is far from over. We'll see variants in the next weeks at least.

Interesting article on Ars Technica | massive-cryptocurrency-botnet-used-leaked-nsa-exploits-weeks-before-wcry

Yes, reading this....makes you wonder what else is out there that we don't know about...

Assembling a botnet the size of the one that managed WannaCry and keeping it under wraps for two to three weeks is a major coup. Monday's revelation raises the possibility that other botnets have been built on the shoulders of the NSA but have yet to be identified.

I cleaned a system that had been hit with a Bitcoin Miner once - scary stuff!

Latest WanaCrypt infection rates from MalwareTech site ( The tracker site went down from 1600, but is back online now). Showing nearly 4.5k new infections/hour and rising for a total of over 350k machines infected so far since Friday.




PewPewPew (realtime tracker) is getting really noisy, and unstable as the number of exploits increase.

Fafhrd said:

Latest WanaCrypt infection rates from MalwareTech site ( The tracker site went down from 1600, but is back online now). Showing nearly 4.5k new infections/hour and rising for a total of over 350k machines infected so far since Friday.




PewPewPew (realtime tracker) is getting really noisy, and unstable as the number of exploits increase.

Thanks for the update Fafhrd. Compromised servers are also huge problem. This attack was well prepared, and attackers won't stop easy.

I noticed the infection rate seemed to be climbing earlier today - many more PEWS.