Symantec Security Response – UPDATED – Two Possible Links Tie Wannacry Ransomware to Lazarus Group
UPDATED
Symantec has uncovered two possible links that loosely tie the WannaCry ransomware attack and the Lazarus group:
• Co-occurrence of known Lazarus tools and WannaCry ransomware: Symantec identified the presence of tools exclusively
used by Lazarus on machines also infected with earlier versions of WannaCry. These earlier variants of WannaCry did not
have the ability to spread via SMB. The Lazarus tools could potentially have been used as method of propagating
WannaCry, but this is unconfirmed.
• Shared code: As tweeted by Google’s Neel Mehta, there is some shared code between known Lazarus tools and the WannaCry
ransomware. Symantec has determined that this shared code is a form of SSL. This SSL implementation uses a specific
sequence of 75 ciphers which to date have only been seen across Lazarus tools (including Contopee and Brambul) and
WannaCry variants.
While these findings do not indicate a definite link between Lazarus and WannaCry, we believe that there are sufficient
connections to warrant further investigation. We will continue to share further details of our research as it unfolds.
A virulent new strain of ransomware known as WannaCry (Ransom.Wannacry) has hit hundreds of thousands of computers
worldwide since its emergence on Friday, May 12. WannaCry is far more dangerous than other common ransomware types
because of its ability to spread itself across an organization’s network by exploiting a critical vulnerability in
Windows computers, which was patched by Microsoft in March 2017 (MS17-010). The exploit, known as “Eternal Blue” was
released online in April in the latest of a series of leaks by a group known as the Shadow Brokers, who claimed that it
had stolen the data from the Equation cyber espionage group.