DoublePulsar explained

Fullname:Pulsar Vulnerability
Technical Name:
  • Double Variant
    • Trojan:Win32/DoublePulsar (Microsoft)
    • Backdoor.DoublePulsar (Fortiguard)
  • Dark Variant
Family:Pulsar (backdoor family)
Author:Equation Group

DoublePulsar is a backdoor implant tool developed by the U.S. National Security Agency's (NSA) Equation Group that was leaked by The Shadow Brokers in early 2017. The tool infected more than 200,000 Microsoft Windows computers in only a few weeks,[3] [4] [5] [6] [7] and was used alongside EternalBlue in the May 2017 WannaCry ransomware attack.[8] [9] [10] A variant of DoublePulsar was first seen in the wild in March 2016, as discovered by Symantec.[11]

Sean Dillon, senior analyst of security company RiskSense Inc., first dissected and inspected DoublePulsar.[12] [13] He said that the NSA exploits are "10 times worse" than the Heartbleed security bug, and use DoublePulsar as the primary payload. DoublePulsar runs in kernel mode, which grants cybercriminals a high level of control over the computer system.[4] Once installed, it uses three commands: ping, kill, and exec, the latter of which can be used to load malware onto the system.[12]

Notes and References

  1. Web site: Trojan.Darkpulsar . . https://web.archive.org/web/20191003212706/https://www.symantec.com/security-center/writeup/2017-042107-1152-99 . 3 October 2019 . en.
  2. Web site: Win32/Equation.DarkPulsar.A ESET Virusradar . www.virusradar.com.
  3. Double Pulsar NSA leaked hacks in the wild. Bruce. Sterling. Wired .
  4. News: Seriously, Beware the 'Shadow Brokers'. Bloomberg . 4 May 2017. www.bloomberg.com.
  5. Web site: DoublePulsar malware spreading rapidly in the wild following Shadow Brokers dump. 25 April 2017.
  6. Web site: Wana Decrypt0r Ransomware Using NSA Exploit Leaked by Shadow Brokers Is on a Rampage.
  7. Web site: >10,000 Windows computers may be infected by advanced NSA backdoor. 21 April 2017 .
  8. Web site: Today's Massive Ransomware Attack Was Mostly Preventable; Here's How To Avoid It. Dell. Cameron. 13 May 2017 .
  9. Web site: How One Simple Trick Just Put Out That Huge Ransomware Fire. Thomas. Fox-Brewster. .
  10. Web site: Player 3 Has Entered the Game: Say Hello to 'WannaCry'. blog.talosintelligence.com. 12 May 2017 . 2017-05-15.
  11. Web site: Stolen NSA hacking tools were used in the wild 14 months before Shadow Brokers leak. arstechnica.com. 7 May 2019 . 2019-05-07.
  12. Web site: DoublePulsar Initial SMB Backdoor Ring 0 Shellcode Analysis. zerosum0x0.blogspot.com. 21 April 2017 . 2017-05-16.
  13. Web site: NSA's DoublePulsar Kernel Exploit In Use Internet-Wide. threatpost.com. 24 April 2017 . 2017-05-16.

This article is licensed under the GNU Free Documentation License. It uses material from the Wikipedia article "DoublePulsar".

Except where otherwise indicated, Everything.Explained.Today is © Copyright 2009-2024, A B Cryer, All Rights Reserved. Cookie policy.