US security agency 'linked to Baltimore hack'
EternalBlue tool, used to exploit a flaw of the same name, allegedly linked to National Security Agency
A tool developed by the US National Security Agency (NSA) that exploits a flaw in Windows is behind the ongoing ransomware attack on the city of Baltimore, according to reports.
It's called EternalBlue and according to The New York Times, it's been used to shut down Baltimore's government, locking employees out of email accounts and residents out of essential online services since 7 May.
Confusingly, EternalBlue exploits a vulnerability also called EternalBlue, which is a flaw in certain versions of Microsoft's Windows XP and Vista systems, allowing hackers to execute remote commands on their target. The EternalBlue tool was developed by the NSA in the early part of this decade and was in use for more than five years, according to the Washington Post, until it was stolen from the agency in April 2017 by the hacking group The ShadowBrokers, which promptly leaked it online. .
The EternalBlue flaw has since been used to cause cyber destruction around the world, including high-profile attacks such as WannaCry in May 2017, the NSA being forced to come clean to Microsoft, and the NotPetya attacks in June of the same year.
Now EternalBlue is reportedly behind the Baltimore ransomware attacks that have shut the city down for almost a month and the local government want answers from the NSA. The agency has never confirmed how it came to lose control of its hacking tool, nor officially commented on the affair.
Some have criticised Baltimore's, however, saying that if the ransomware is ExternalBlue-based the city has had plenty of time to update its systems and close off the vulnerability.
"EternalBlue was released over two years ago. If an organisation has substantial numbers of Windows machines that have gone 2 years without patches, then that's squarely the fault of the organization, not EternalBlue," tweeted ethical hacker Rob Graham.
Baltimore's government hasn't been able to send and receive emails since the attack and some of its employees have tried to sign up for Gmail accounts to continue with work. But these accounts were stopped, instantly, by Google's systems.
In a statement to The Verge, a Google spokesperson said its security systems had detected the creation of several accounts in a short period of time and had automatically shut them down.
"We have restored access to the Gmail accounts for the Baltimore city officials," the spokesperson said. "Our automated security systems disabled the accounts due to the bulk creation of multiple consumer Gmail accounts from the same network."
-
Cisco's infrastructure unification push aims to simplify management for the agentic eraNews The company aims to put the power in customers’ hands while emphasizing the importance of network efficiency
-
Hackers are capitalizing on AI hype to ramp up social engineering attacksNews Microsoft says cyber criminals are impersonating popular AI platforms to deliver malware
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals
-
Ransomware negotiator sentenced for role in major cyber crime groupNews Deniss Zolotarjovs was a key player in a group associated with Conti
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Security leaders overconfident about ransomware recovery
News Few manage to recover all their data, and many experience business disruption
-
German authorities want your help finding the hackers behind GandCrab and REvilNews Daniil Maksimovich Shchukin and Anatoly Sergeevitsch Kravchuk are believed to have made millions from ransomware as a service schemes
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in life
News With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
