The WannaCry ransomware campaign wasn’t the first to use the EternalBlue and DoublePulsar exploits. ESET has revealed that they were first used at the end of April when hackers Monero cryptocurrency mining software.
The massive campaign that spread the WannaCry (aka WannaCryptor) ransomware wasn’t the only recent large-scale infection misusing the EternalBlue and DoublePulsar exploits, leaked by Shadow Brokers. The same mechanism was misused by black-hats as early as the end of April, when they opted for the off-the-shelf Monero cryptocurrency mining software, instead of the encrypting payload.
This campaign detected as Win32/CoinMiner.AFR and Win32/CoinMiner.AFU started only a few days after the NSA tools leaked online. ESET had network detections for the vulnerability deployed on April 25th – three days before the first attack attempts by these miners for Monero cryptocurrency.
The biggest uptick was recorded only hours before the mining ransomware’s global outbreak, on May 10th. On that day, mining malware detections increased from hundreds of detections per day to thousands. We have seen such attempts in as many as 118 countries, with Russia, Taiwan and Ukraine topping the list.
However, the mining software consumed system resources so intensely that in some cases it rendered the infected machines unresponsive.
Interestingly the CoinMiner attacks also blocked the 445 port used by the EternalBlue exploit to get into the machine, essentially closing the door to any subsequent infection using the same vector – including WannaCry. If the miners hadn’t taken this precaution, the number of WannaCry infections could have been even greater than reported.
So how bad was the WannaCry attack?
According to ESET telemetry, since Friday, the machines of more than 14.000 users who have enabled ESET LiveGrid, has reported as many as 66.000 WannaCry attack attempts on their devices.
These attacks mainly targeted Russian computers, with over 30.000 attacks, followed by Ukraine and Taiwan, where in both cases they were close to the 8.000 mark.
The chaos that ensued after WannaCry’s global outbreak seems to have motivated other black-hats to scale up their efforts too. We have seen a significant increase in the number of malicious emails sent out by the notorious Nemucod operators, spreading another ransomware.
Also, WannaCry fakes have emerged. These try to ride the wave of its fame by using the same GUI and layout. However, the encrypting capability was missing in all seen instances.
What should you do to stay safe?
- Since the EternalBlue exploit uses a vulnerability in Windows that has been already patched by Microsoft, the first thing would be to verify the completion of the update and the patch to your operating system.
- Use a reliable security solution that utilises multiple layers to protect you from similar threats in the future.
- It is best practice to keep backups on a remote hard disk or location that will not be hit in case of a network infection.
- We recommend that users do not pay ransoms – be it a case of the true WannaCry or any other ransomware. There have been no reported cases where pursuing such a step would lead to decryption. On the contrary, there have been multiple stories documenting the opposite – no decryptor or key being sent after the payment was made. Also, there seems to be no way for the attackers to match the payment to the specific victim who sent it to one of the shared BitCoin wallets.
South Africans are searching in the dark, according to the latest Google Search trends.
With more 1 million search queries generated in the space of 76 hours, load-shedding was by far the top trending search on Google South Africa this week.
Valentine’s Day came a distant second.
After news emerged last Sunday of the impending stage 3 load shedding, South Africans had generated more than 1-million load-shedding search queries by the time Tuesday came around:
- “Loadshedding schedule” – generated more than 100k searches on Sunday
- “Load shedding schedule” – generated more than 100k searches on Sunday
- “Eskom load shedding” – generated more than 100k searches on Sunday
- “Load shedding Cape Town” – generated more than 50k searches on Sunday
- “Load shedding schedule” – generated more than 400k on Monday
- “Load shedding Johannesburg” – generated more than 20k searches on Monday
- “Load shedding schedule” – generated more than 200k search queries on Tuesday
Leading up to Valentine’s Day, South Africans generated close to 300k search queries related to the romantic festival, including searches for quotes and gift ideas:
- “Valentines Day” generated more than 100k search queries on Thursday
- “Happy Valentines Day Images” and “Valentines Day Images” generated more than 10k search queries each on Thursday, with “Happy Valentines Day 2019” generating more than 20k search queries on Wednesday
- “Valentines Day Specials 2019” generated more than 5k search queries on Thursday
- “Love quotes” generated more than 5k search queries on Thursday
- “Valentines Day quotes” generated more than 100k search queries and “Valentine messages” generated more than 50 000 search queries on Wednesday
Search trends information is gleaned from data collated by Google based on what South Africans have been searching for and asking Google. Google processes more than 40 000 search queries every second. This translates to more than a billion searches per day and 1.2 trillion searches per year worldwide. Live Google search trends data is available at https://www.google.co.za/trends/hottrends#pn=p40
Thanks to the growing popularity of video-on-demand services, there’s a new opportunity to help kickstart the careers of local filmmakers.
Numerous Hollywood blockbusters (District 9, Tomb Raider 2018, and The Avengers: Age of Ultron to name a few) have featured substantial shoots in Johannesburg and Cape Town. While providing great opportunities for SA’s production talent, aspiring writers and directors don’t get the same benefit.
So where can local creatives showcase their work? Broadcast TV isn’t a natural home for unknown short films, and while self-publishing platforms are readily available hosting options, it’s tough to get noticed and get traffic when competing with videos from across the planet.
But with the emergence of video-on-demand services into the mainstream, there’s now a solution. The African film school AFDA has teamed up with the streaming service Showmax to give local talent a much larger platform than ever before. From 18 February, eighteen of the best recent short films made by AFDA students from their Johannesburg, Cape Town, Durban and Port Elizabeth campuses will be live on Showmax. Drama, documentary, fantasy, and animation are all represented, in pieces running from under eight minutes to almost half-an-hour long. The full list of movies is included below.
Teresa Passchier, CEO of AFDA, said: “AFDA, Africa’s number-one school for the Creative Economy, is proud to kickstart this exciting and meaningful journey with Showmax and AFDA students, ensuring emerging young African filmmakers’ voices are heard and given a platform. It’s ground-breaking to share young, local, culturally relevant content on the same platform as Hollywood blockbusters. I am certain that this unique initiative will serve to boost and develop the African film industry and the careers of many young South African and African students alike.”
Included in the short films coming to Showmax are the award winners Junior and O-Puncha. Junior, directed by Bert Dijkstra, picked up the Audience Award in the Made in South Africa Competition at the shnit Worldwide Shortfilmfestival Awards 2017. O-Puncha, directed by Adam Hansen, won two awards at the 5th annual Eldorado Film Festival: Best Student Made Short, and Best Editing – Alexander La Cock.
Another celebrated film is Sicela Amanzi directed by Mlu Godola, which talks to the subject of water shortage. The film’s heroine Zoleka is a mild-mannered young woman forced to go to extreme lengths when a small community’s only source of water unexpectedly collapses. The power of films like this is they shine a light on critical topical issues in new ways.
Speaking about working with the film school, Candice Fangueiro, Head of Content for Showmax, said: “There’s
AFDA is an Academy Award-winning institution, founded in 1994, and the first and only African film school to win an Oscar – for the Best Foreign Student film in 2006, the postgraduate film Elalini, directed by Tristan Holmes.
The full list of AFDA short films coming to Showmax is as follows:
|Lullaby from the Crypt||Keenan Lott & Raven Davids||Animation|
|Ko Ga Cherenyane||Sibonokuhle Myataza||Documentary|
|Mallemeule||Jaco Van Bosch||Drama|
|Canal Street||Brodie Muirhead||Drama|
|On the Fence||Warrick Bews||Drama|
|The Righteous Few||Lindo Langa||Drama|
|Hlogoma Peak||Luke Ahrens||Drama|
|Frozen Flame||Cameron Heathman||Animation|
|Wolf||Brett van Dort||Fantasy|
|The Walk Home||Sisanda Dyantyi||Drama|
|Doreen||Luvuyo Equiano Nyawose||Drama|
|Sicela Amanzi||Mlu Godola||Drama|