Researchers say EternalBlue, the NSA exploit used in WannaCry, was used in an earlier and possibly larger-scale hack, to install Adylkuzz cryptocurrency miner
Campaign that flew under the radar used hacked computers to mine Monero currency. — On Friday, ransomware called WannaCry …
Context & Ripple Effects
Days after coverage of the WannaCry outbreak traced the worm to EternalBlue — an NSA exploit dumped by the Shadow Brokers — researchers report the same exploit had already been deployed, more quietly, to install the Adylkuzz Monero miner, and possibly at greater scale. The significance is sequencing: the leaked tooling was being cashed out before anyone noticed.
The corpus also shows where this went: researchers later detailed Smominru, a half-million-machine Monero botnet built on the same exploit, Wired reported EternalBlue became a go-to criminal utility a year after the leak, and illicit mining surged in 2018 in reporting that tied the spike directly to the leak itself.
First-order effects
- Organizations that only scrambled after WannaCry made headlines may have been running Adylkuzz silently beforehand, because the same unpatched Windows flaw fed both campaigns.
- Unlike ransomware, a Monero miner steals compute rather than files, so victims whose machines were enslaved for Adylkuzz had no encryption event to alert them.
Second-order effects
- Adylkuzz demonstrated that mining monetizes the same hacked fleet without the self-propagating noise of WannaCry, a template other crews copied at scale in Smominru's server-focused botnet.
- Defenders' detection priorities shift accordingly: with quiet mining viable on the identical vulnerability, security teams must watch CPU baselines across unpatched Windows estates, not just wait for visible encryption.
Third-order effects
- Once a stockpiled NSA capability escaped into open circulation, every subsequent campaign reused it — pointing toward an industry assumption that leaked government exploits will proliferate and be monetized indefinitely, making rapid patching of long-tail Windows machines the only durable defense.
The trend: Leaked NSA exploit code is converting cryptocurrency mining into the default quiet monetization for hijacked Windows fleets, with each new campaign building on the same dumped tooling.