WannaCry Defense

After several days there is still much speculation regarding how this Microsoft Vuln (CVE-2017-0145) is initially being exploited.  This is due to the fact that the worm spreads via SMB so aggressively after infestation that it's hard to back track.  However, per this report last night, most people are leaning towards inbound emails with attachments.


We at ESPO have been watching the Forcepoint Email Sandbox since Friday and agree.  This morning is a perfect example.  Emails are coming in with attachments referencing invoices:

As you'd expect, and our endusers unfortunately don't, it's socially engineered to pop open a Word Doc with Macro:

As we follow the bouncing ball you'll note that this blended threat then pulls the actual exploit via the web channel (still in the clear... not using https):

How are the AntiVirus/Next Gen Endpoint guys doing regarding detection rate?  Ummm... not good (only 10 out of 57 companies currently detect it):

In summary, ping us at ESPO to discuss how a holistic security solution (Web, Email, Firewall/IPS, Patch Mgt and DLP) can preclude you from wasting time on this latest worm.