Video | Business Headlines | Internet | Science | Scientific Ethics | Technology | Search

 

UPDATED – Two Possible Links Tie Wannacry to Lazarus Group

Symantec Security Response – UPDATED – Two Possible Links Tie Wannacry Ransomware to Lazarus Group

UPDATED

Symantec has uncovered two possible links that loosely tie the WannaCry ransomware attack and the Lazarus group:

• Co-occurrence of known Lazarus tools and WannaCry ransomware: Symantec identified the presence of tools exclusively used by Lazarus on machines also infected with earlier versions of WannaCry. These earlier variants of WannaCry did not have the ability to spread via SMB. The Lazarus tools could potentially have been used as method of propagating WannaCry, but this is unconfirmed.

• Shared code: As tweeted by Google’s Neel Mehta, there is some shared code between known Lazarus tools and the WannaCry ransomware. Symantec has determined that this shared code is a form of SSL. This SSL implementation uses a specific sequence of 75 ciphers which to date have only been seen across Lazarus tools (including Contopee and Brambul) and WannaCry variants.

While these findings do not indicate a definite link between Lazarus and WannaCry, we believe that there are sufficient connections to warrant further investigation. We will continue to share further details of our research as it unfolds.

A virulent new strain of ransomware known as WannaCry (Ransom.Wannacry) has hit hundreds of thousands of computers worldwide since its emergence on Friday, May 12. WannaCry is far more dangerous than other common ransomware types because of its ability to spread itself across an organization’s network by exploiting a critical vulnerability in Windows computers, which was patched by Microsoft in March 2017 (MS17-010). The exploit, known as “Eternal Blue” was released online in April in the latest of a series of leaks by a group known as the Shadow Brokers, who claimed that it had stolen the data from the Equation cyber espionage group.


© Scoop Media

 
 
 
 
 
Business Headlines | Sci-Tech Headlines

 

Rocket Lab: Launch Expected

Rocket Lab has delayed the roll out of the launch vehicle called Electron by one day, due to weather conditions. The planned launch attempt will now take place on Tuesday, May 23, 2017. More>>

ALSO:

Budget: Irrigate (Good Times, Come On!)

Additional grant funding of $26.7 million over the next three years plus a capital boost of $63 million towards irrigation investments in Budget 2017 will deliver economic and environmental benefits through better use of water... More>>

ALSO:

Silver Fern Farms: Proposal To Close Fairton Sheepmeat Plant

Silver Fern Farms has advised its people of the proposal to permanently close the site, and has discussed potential transfer options to its other sites in the region as part of the consultation process...
More>>

ALSO:

MPI: Myrtle Rust Appears In Taranaki

The nursery in Waitara (just north of New Plymouth) reported suspected myrtle rust symptoms on young plants to the Ministry’s 0800 number yesterday (Tuesday). More>>

ALSO: