NNM detected the presence of DOUBLEPULSAR on the remote Windows host. DOUBLEPULSAR is one of multiple Equation Group SMB implants and backdoors disclosed on 2017/04/14 by a group known as the 'Shadow Brokers'. The implant allows an unauthenticated, remote attacker to use SMB as a covert channel to exfiltrate data, launch remote commands, or execute arbitrary code.

The remote system may be affected by ransomware that encrypts most or all of the files on a user's computer. Then, the software demands that a ransom be paid in order to have the files decrypted. This attack is related to the recent ShadowBrokers dump containing NSA weaponized software exploits.

The remote Windows host is affected by the following vulnerabilities :

  - Multiple remote code execution vulnerabilities exist in     Microsoft Server Message Block 1.0 (SMBv1) due to     improper handling of certain requests. An     unauthenticated, remote attacker can exploit these     vulnerabilities, via a specially crafted packet, to     execute arbitrary code. (CVE-2017-0143, CVE-2017-0144,     CVE-2017-0145, CVE-2017-0146, CVE-2017-0148)

  - An information disclosure vulnerability exists in     Microsoft Server Message Block 1.0 (SMBv1) due to     improper handling of certain requests. An     unauthenticated, remote attacker can exploit this, via a     specially crafted packet, to disclose sensitive     information. (CVE-2017-0147)

ETERNALBLUE, ETERNALCHAMPION, ETERNALROMANCE, and ETERNALSYNERGY are four of multiple Equation Group vulnerabilities and exploits disclosed on 2017/04/14 by a group known as the Shadow Brokers. WannaCry / WannaCrypt is a ransomware program utilizing the ETERNALBLUE exploit, and EternalRocks is a worm that utilizes seven Equation Group vulnerabilities. Petya is a ransomware program that first utilizes CVE-2017-0199, a vulnerability in Microsoft Office, and then spreads via ETERNALBLUE.

Nessus detected the presence of DOUBLEPULSAR on the remote Windows host. DOUBLEPULSAR is one of multiple Equation Group SMB implants and backdoors disclosed on 2017/04/14 by a group known as the Shadow Brokers. The implant allows an unauthenticated, remote attacker to use SMB as a covert channel to exfiltrate data, launch remote commands, or execute arbitrary code.

EternalRocks is a worm that propagates by utilizing DOUBLEPULSAR.

The remote Windows host is missing a security update. It is, therefore, affected by the following vulnerabilities :

  - Multiple remote code execution vulnerabilities exist in     Microsoft Server Message Block 1.0 (SMBv1) due to     improper handling of certain requests. An     unauthenticated, remote attacker can exploit these     vulnerabilities, via a specially crafted packet, to     execute arbitrary code. (CVE-2017-0143, CVE-2017-0144,     CVE-2017-0145, CVE-2017-0146, CVE-2017-0148)

  - An information disclosure vulnerability exists in     Microsoft Server Message Block 1.0 (SMBv1) due to     improper handling of certain requests. An     unauthenticated, remote attacker can exploit this, via a     specially crafted packet, to disclose sensitive     information. (CVE-2017-0147)

ETERNALBLUE, ETERNALCHAMPION, ETERNALROMANCE, and ETERNALSYNERGY are four of multiple Equation Group vulnerabilities and exploits disclosed on 2017/04/14 by a group known as the Shadow Brokers. WannaCry / WannaCrypt is a ransomware program utilizing the ETERNALBLUE exploit, and EternalRocks is a worm that utilizes seven Equation Group vulnerabilities. Petya is a ransomware program that first utilizes CVE-2017-0199, a vulnerability in Microsoft Office, and then spreads via ETERNALBLUE.

ID	Name	Product	Family	Published	Updated	Severity
700059	SMB Server DOUBLEPULSAR Backdoor / Implant Detection (EternalRocks)	Nessus Network Monitor	Web Servers	4/18/2017	4/22/2019	critical
700099	Ransomware Traffic Detected (WannaCry)	Nessus Network Monitor	Generic	5/15/2017	3/6/2019	critical
97833	MS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE) (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks) (Petya) (uncredentialed check)	Nessus	Windows	3/20/2017	12/29/2025	high
99439	SMB Server DOUBLEPULSAR Backdoor / Implant Detection (EternalRocks)	Nessus	Windows	4/18/2017	4/8/2026	high
97737	MS17-010: Security Update for Microsoft Windows SMB Server (4013389) (ETERNALBLUE) (ETERNALCHAMPION) (ETERNALROMANCE) (ETERNALSYNERGY) (WannaCry) (EternalRocks) (Petya)	Nessus	Windows : Microsoft Bulletins	3/15/2017	12/30/2025	high

Detections

Analytics

Plugins Search

critical

critical

high

high

high