Shadow Brokers, who leaked WannaCry SMB Exploit, are back with more 0-Days

[Parsh]

The infamous hacking collective Shadow Brokers – the one who leaked the Windows SMB exploit in public that led to last weekend's WannaCrypt menace – are back, this time, to cause more damage.

In typically broken English, the Shadow Brokers published a fresh statement (with full of frustration) a few hours ago, promising to release more zero-day bugs and exploits for various desktop and mobile platforms starting from June 2017:

"TheShadowBrokers is launching new monthly subscription model. Is being like [the] wine of month club. Each month peoples can be paying membership fee, then getting members only data dump each month."

The group will sell new zero-day exploits and hacking tools to private members with paid monthly subscription, instead of telling them to Microsoft, and that's the terrible side of the reveal.

Get Ready for the 'Wine of Month Club'

So, anyone buying the membership of the "wine of month club" would be able to get exclusive access to the upcoming leaks, which the Shadow Brokers claims would include:

• Exploits for web browsers, routers, and smartphones.
• Exploits for operating systems, including Windows 10.
• Compromised data from banks and Swift providers.
• Stolen network information from Russian, Chinese, Iranian, and North Korean nuclear missile programs.

Before publicly dumping their found exploits in April, the Shadow Brokers put an auction of cyber weapons stolen from NSA’s elite hacking team called Equation Group for 1 Million Bitcoin.

After failed auction, the hacking group even put up those hacking tools and exploits for direct sale on an underground site, categorizing them into a type — like "exploits," "Trojans," and "implant" — each of which ranged from 1 to 100 Bitcoins (from $780 to $78,000).

After failure from all sides, the group started leaking those hacking exploits. Last month, the Shadow Brokers released a Microsoft Windows SMB exploit that was used by the WannaCry ransomware, which infected 200,000 machines in 150 countries within just 48 hours.

While talking about the WannaCry ties with North Korean state-sponsored hacking group Lazarus Group, the group said:
"The Oracle is telling theshadowbrokers North Korea is being responsible for the global cyber attack Wanna Cry. Nukes and cyber attacks, America has to go to war, no other choices!"

Neel Mehta, a security researcher at Google, found evidence that suggests the WannaCry ransomware, that infected 300,000 machines in 150 countries over the weekend, is linked to a state-sponsored hacking group in North Korea, known for cyber attacks against South Korean organizations.
Neel discovered that the code found in the WannaCry malware—one that first surfaced in February—was identical to the code used in an early 2015 version of Cantopee, a malicious backdoor developed by Lazarus Group, believed to be a state-sponsored hacking group linked to the North Korean government.

Security researchers from Kaspersky Lab, Intezer, Symantec, and Comae Technologies immediately followed the tip from Neel and confirmed a strong link between WannaCry and other malware families, including Lazarus, Joanap, and Brambul, which suggests WannaCry was written or modified by the same author. Find more over here.

 

[Winter Soldier]

Thanks @Parsh

Unfortunately, I think WannaCry is only a "preview" ... a way to select what is breakable and how. Or maybe it is part of a big subversive program to highlight the security vulnerabilities of our infrastructure.

 

[Arin]

OMG .
Why Microsoft is silent ?
Microsoft please help us .

 

[Winter Soldier]

OMG .
Why Microsoft is silent ?
Microsoft please help us .

The attack's tools of the NSA have been leaked and then published by ShadowBrokers and the problem is that an exploit can get administrator privileges on the victim's machine (local privilege escalation) by exploiting a vulnerability of the same operating system.
In short, an exploit takes advantage of a flaw in the system to take an action that the system doesn't realize.

Needless to say, the exploits made public allow us to fix these flaws but in this case the situation can be serious.