From Yahoo News and other sources, I just learned that another large-scale cyberattack is underway around the world, which uses the same computer vulnerabilities as WannaCry.

It's called Adylkuzz and it mines the cryptocurrency, Monero in the background, so the computer user doesn't really know it is there. The vulnerabilities associated with Windows that the WannaCry attackers used are called EternalBlue and DoublePulsar and these are what installs the cryptocurrency mining scripts. It appears that this Adylkuzz malware is larger than the WannaCry ransomware infection with hundreds of thousands of computers and servers now infected. It was discovered later than WannaCry because it exists silently in the background of the computer. It took a specialized test to even detect it. A lab was testing a computer infected with WannaCry when they discovered the Monero mining going on in the background.

Symptoms of this attack include loss of access to shared Windows resources and degradation of PC and server performance. Several large organizations reported network issues this morning that were originally attributed to the WannaCry campaign. However, because of the lack of ransom notices, we now believe that these problems might be associated with Adylkuzz activity. However, it should be noted that the Adylkuzz campaign significantly predates the WannaCry attack, beginning at least on May 2 and possibly as early as April 24. This attack is ongoing and, while less flashy than WannaCry, is nonetheless quite large and potentially quite disruptive.

Upon successful exploitation via EternalBlue, machines are infected with DoublePulsar. The DoublePulsar backdoor then downloads and runs Adylkuzz from another host. Once running, Adylkuzz will first stop any potential instances of itself already running and block SMB communication to avoid further infection. It then determines the public IP address of the victim and download the mining instructions, cryptominer, and cleanup tools.

It appears that at any given time there are multiple Adylkuzz command and control (C&C) servers hosting the cryptominer binaries and mining instructions. -Proofpoint

Some of the computers infected with the Adylkuzz virus have mined over $22,000 worth of Monero. And from the looks of it, this malware was going on well before the WannaCry ransomware was unleashed.

Wow, and if cryptocurrency had a bad name before, this is just making it worse!
Do you know of anyone or any company that is currently experiencing the WannaCry ransomware?