Loading story…
A renewed WannaMine outbreak is compromising Windows systems by exploiting the SMB flaws addressed in MS17-010, including the EternalBlue attack path that was also used by WannaCry. After achieving privileged code execution on unpatched hosts, the worm uses PowerShell and WMI to identify system architecture, fetch the correct payload, move laterally across the network, and execute its cryptomining components directly in memory.
Investigators found the malware also compiles and uses PingCastle to locate additional vulnerable machines, deploys a PowerShell implementation of Mimikatz for credential theft and lateral movement, and hides components in WMI classes while creating WMI event-based persistence. It further changes power settings to keep systems active for mining and terminates competing miners on common mining ports, underscoring that organizations remain exposed largely because systems vulnerable to the long-patched MS17-010 flaws are still present in enterprise environments.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft issued security bulletin MS17-010 to patch the SMB vulnerabilities later exploited by EternalBlue-based malware such as WannaCry, NotPetya, and WannaMine.
Cybereason's Nocturnus team investigated a new outbreak of WannaMine that spread by exploiting unpatched SMB services with EternalBlue. The analyzed variant used PowerShell and WMI for execution, lateral movement, persistence, credential theft, and in-memory cryptomining.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that large-scale botnets continued to spread by abusing known, wormable vulnerabilities and weakly defended internet-facing systems. Proofpoint detailed the **Smominru** operation, a Monero cryptomining botnet that infected more than **526,000 Windows hosts**—likely many of them servers—primarily through the `EternalBlue` SMB flaw (`CVE-2017-0144`), with indications of additional use of `EsteemAudit` (`CVE-2017-0176`) and attacks via SQL Server. The operators were estimated to have mined about **8,900 Monero**, worth roughly **$2.8 million to $3.6 million** at the time, while using Windows Management Instrumentation in an unusual way to support propagation and mining. Separate research highlighted a **Mirai** spreader that introduced additional risk by expanding the malware’s ability to compromise vulnerable devices and propagate further across exposed environments. Together, the reports show threat actors repeatedly monetizing unpatched infrastructure through self-spreading malware, while adapting quickly when defenders disrupt infrastructure, block wallets, or sinkhole command-and-control resources. The activity underscored the operational and financial impact on organizations, including degraded server performance, increased energy costs, and continued exposure from legacy vulnerabilities that remained widely exploitable.
Aug 15, 2026
Researchers reported that **GhostMiner** evolved into a fileless cryptocurrency-mining malware strain that abuses **Windows Management Instrumentation (WMI)** for persistence, payload execution, and evasion on Windows systems. The malware stores Base64-encoded PowerShell in a WMI class named `PowerShell_Command`, installs WMI event subscriptions to relaunch itself, drops a Monero miner as `C:\Windows\Temp\lsass.exe`, and maintains backdoor communication with command-and-control infrastructure including `118.24.63.208` and `103.105.59.68`. The campaign also aggressively removes rival cryptominers by terminating competing processes and services, deleting scheduled tasks, blocking related network traffic, and altering hosts file entries tied to families such as **MyKings**, **PowerGhost**, **PCASTLE**, and **BULEHERO**. The activity aligns with the broader **MITRE ATT&CK `T1546.003`** technique, which documents WMI event subscription abuse as a persistence method used by multiple malware families and threat actors, underscoring how GhostMiner weaponized native Windows management features to remain resident while monopolizing infected hosts for illicit Monero mining.
Aug 15, 2026
WannaCry encrypted files across organizations worldwide after a worm component exploited the Windows SMBv1 flaw patched in **MS17-010**, driving rapid propagation beyond initial phishing-based infections. Reported victims included the UK's **NHS**, **Telefónica**, **Iberdrola**, Russia's Interior Ministry, **FedEx**, and **Deutsche Bahn**, while hotspots were reported in Ukraine, Taiwan, and later China. Infected systems typically displayed ransom demands of **$300** or **$600** in Bitcoin, and Microsoft issued emergency patches even for unsupported platforms such as **Windows XP** as governments and incident responders urged organizations to report infections and patch exposed systems. Technical analysis found the malware checked a kill-switch domain, scanned local and random external IP ranges, looked for the **DoublePulsar** backdoor, and used **EternalBlue** when DoublePulsar was absent to deliver the ransomware payload. WannaCry used **RSA-2048** and **AES-128** for encryption, deleted shadow copies and recovery artifacts, terminated database and Exchange-related processes, and communicated with Tor hidden services over an encrypted protocol. Later reporting indicated **Windows 7** and **Windows Server 2008** accounted for most infections, while many **XP** systems crashed instead of reliably propagating the worm; researchers also noted the kill-switch likely prevented far more infections and that shared Bitcoin wallets reduced confidence that paying victims would be consistently decrypted.
Aug 14, 2026