WannaMine Cryptominer Spreads via EternalBlue on Unpatched Windows Hosts

A renewed WannaMine outbreak is compromising Windows systems by exploiting the SMB flaws addressed in MS17-010, including the EternalBlue attack path that was also used by WannaCry. After achieving privileged code execution on unpatched hosts, the worm uses PowerShell and WMI to identify system architecture, fetch the correct payload, move laterally across the network, and execute its cryptomining components directly in memory.

Investigators found the malware also compiles and uses PingCastle to locate additional vulnerable machines, deploys a PowerShell implementation of Mimikatz for credential theft and lateral movement, and hides components in WMI classes while creating WMI event-based persistence. It further changes power settings to keep systems active for mining and terminates competing miners on common mining ports, underscoring that organizations remain exposed largely because systems vulnerable to the long-patched MS17-010 flaws are still present in enterprise environments.