Experts from Eset and Recorded Future say ransomware scans systems for passwords to send to server, uses NSA “EternalBlue” exploit, is “Petya” variant
Like earlier ransomware worm, new attacks use potent exploit stolen from the NSA.
Context & Ripple Effects
Six weeks after the WannaCry outbreak first put the NSA's leaked EternalBlue exploit into mass criminal use, Eset and Recorded Future report a new worm doing the same thing — but with an added twist: it scans infected machines for passwords and ships them to a server, meaning compromise spreads beyond unpatched Windows boxes to any machine whose credentials were harvested.
The arc matters because researchers had already caught EternalBlue powering a quieter, possibly larger Adylkuzz cryptocurrency-mining campaign between WannaCry and today. This third reuse confirms the leak is not a one-off event but a standing arsenal, and the follow-on finding that the 'ransomware' was actually altered to wipe systems points toward a state actor rather than profit-seeking criminals.
First-order effects
- Organizations hit by the outbreak face two problems at once: encrypted-or-wiped machines, and harvested passwords already on an attacker's server — so patching SMB alone does not end the incident, and every credential on touched systems has to be treated as burned.
Second-order effects
- Security teams and incident responders must now plan for EternalBlue-based worms that pair the exploit with credential theft, shifting response playbooks from ransom-payment-and-restore toward network-wide password rotation and lateral-movement forensics.
Third-order effects
- If the pattern holds — EternalBlue still widely unpatched a year later per later reporting, and the payload turning out to be a wiper rather than real ransomware — the line between criminal ransomware and state-sponsored destruction collapses, and the NSA's exploit stockpiling becomes a standing liability for every Windows user.
The trend: Exploits leaked from NSA stockpiles are becoming the default toolkit for successive waves of attacks, escalating from ransomware to miners to outright wipers.