WannaCry Ransomware: Dangerous Strain known as 'EternalRocks' discovered, Researchers Say

After a number of different ransomware assaults that hit enterprises throughout the globe, security researchers have now recognized a brand new pressure of malware "EternalRocks" that's extra bad than WannaCry and is probably more difficult to struggle.

According to the researchers, "EternalRocks" exploits the same vulnerability in windows that helped WannaCry unfold to computers. It also uses a NSA tool known as "EternalBlue" for proliferation, Fortune said on Sunday.

"It additionally makes use of six other NSA instruments, with names like EternalChampion, EternalRomance, and DoublePulsar (which can be a part of WannaCry)," the record said.

In its current kind, "EternalRocks" does now not have any malicious elements-- it does not lock or corrupt information, or use compromised machines to build a botnet - but leaves contaminated computers prone to faraway instructions that could 'weaponise' the infection at any time.

"EternalRocks" is more desirable that WannaCry as a result of it does not have any weaknesses, including the kill switch that a researcher used to help contain the ransomware.

EternalBlue also makes use of a 24-hour activation extend to take a look at to frustrate efforts to study it, the record noted.The final 10 days have seen a wave of cyber-attacks that have rendered companies helpless all over the world.

First it was once WannaCrypt or WannaCry that spread by making the most of a home windows vulnerability that Microsoft launched a security patch for in March. It encrypted recordsdata on infected machines and demanded cost for unlocking them.

WannaCry had some loopholes that made it easier to sluggish and stay away from.

After going through a major "WannaCrypt" ransomware attack, some other form of malware quietly started generating digital money from machines it infected.

Tens of hundreds of computer systems were affected globally by way of the "Adylkuzz attack" that focused machines, let them function and only slowed them down to generate digital money or "Monero" cryptocurrency in the historical past.

Over 56cr People Attacked in india by Ransomware Virus-

What is WannaCry?

 let’s clarify exactly what WannaCry is. This malware is a scary type of trojan virus called “ransomware.” As the name suggests, the virus in effect holds the infected computer hostage and demands that the victim pay a ransom in order to regain access to the files on his or her computer.

 

What Exactly Does Wanna-Cry Do?

RansomWare like WannaCry works by encrypting most or even all of the files on a user’s computer. Then, the software demands that a ransom be paid in order to have the files decrypted. In the case of WannaCry specifically, the software demands that the victim pays a ransom of $300 in bitcoins at the time of infection. If the user doesn’t pay the ransom without three days, the amount doubles to $600. After seven days without payment, WannaCry will delete all of the encrypted files and all data will be lost

How the WannaCry Attack Will Impact Cyber Security

At last count, WannaCry had affected more than 230,000 users in some 150 countries. Prominent among the victims of the attack are the National Health Service (NHS) in the U.K., which found many operations disrupted and had to divert patients to other facilities, Spain’s telecom company Telefonica, U.S.-based FedEx and organizations in South America, Germany, Russia and Taiwan.

Aside from FedEx, the U.S. was surprisingly spared, thanks to an alert researcher who discovered a “kill switch,” or a way to contain the spread of the attack. The hackers behind the attack have been demanding ransoms of $300 in bitcoins from each affected user to unscramble their affected files with threats to double that if payments are not made within 72 hours.

SBI ATMs not affected by ransomware

Amid reports of several ATMs remaining shut due to a possible virus attack by Wanna Cry ransomware, the largest public lender of the country State Bank of India (SBI) on Wednesday said that it has not been affected at all by the malware and all its ATMs were fully functional.
"We have not been impacted at all. None of our ATMs have been asked to shut down," SBI Chief Information Officer Mrutyunjay Mahapatra told IANS.

SBI has close to 59,000 ATMs out of over two lakh ATMs in the country.
Mahapatra said that 80-90 per cent of the old ATMs have already got the security patch, and the remaining are being updated, but none of the ATMs have been shut down as SBI has a secure closed loop network and robust firewalls.
"80-90 per cent of the old ATMs have already got the security patch. Wherever remaining, our engineers are updating. We are doing a review, and putting additional security patch if needed," he said.

Is the attack over?

No.

WannaCry was first discovered on Friday, May 12th, and it had spread to an estimated 57,000 computers in more than 150 different countries around the world by the end of the day. European countries were hit the hardest, and business ground to a halt at several large companies and organizations, including banks, hospitals, and government agencies.

On Saturday, a 22-year-old security researcher named Marcus Hutchins inadvertently slowed the spread of the WannaCry virus when he registered a domain name hidden within the virus’ code in an attempt to track the spread of WannaCry, unintentionally stopping its progress in the process. You can read Hutchins’ story in his blog post titled “How to Accidentally Stop a Global Cyber Attacks.”

Unfortunately, the spread of WannaCry wasn’t actually stopped, but instead slowed.

Learn How to Prevent WannaCry-Like Ransomware Attacks