{"id":211,"date":"2018-05-05T02:30:33","date_gmt":"2018-05-05T02:30:33","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/hackers-are-trying-to-reignite-wannacry-with-nonstop-botnet-attacks\/"},"modified":"2018-05-05T02:30:33","modified_gmt":"2018-05-05T02:30:33","slug":"hackers-are-trying-to-reignite-wannacry-with-nonstop-botnet-attacks","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/hackers-are-trying-to-reignite-wannacry-with-nonstop-botnet-attacks\/","title":{"rendered":"Hackers Are Trying to Reignite WannaCry With Nonstop Botnet Attacks"},"content":{"rendered":"
<\/div>\n

Over the past<\/span> year, two digital disasters have rocked the internet. The botnet known as Mirai knocked a swath of major sites off the web last September, including Spotify, Reddit, and The<\/em> New York Times<\/em>. And over the past week, the WannaCry ransomware outbreak<\/a> crippled systems ranging from health care to transportation in 150 countries before an unlikely “kill-switch” in its code shut it down.<\/p>\n

Now a few devious hackers appear to be trying to combine those two internet plagues: They’re using their own copycats of the Mirai botnet to attack WannaCry’s kill-switch. So far, researchers have managed to fight off the attacks. But in the unlikely event that the hackers succeed, the ransomware could once again start spreading unabated.<\/p>\n

Under Siege<\/h3>\n

Since the WannaCry ransomware worm began to fan out through the internet Friday, security researchers noticed a curious feature. When it infects a computer, it first reaches out to a certain random-looking web address, apparently as part of a check that it’s not running in a “sandbox” environment, which security researchers use to test malware samples safely. If WannaCry connects to a valid server at that specified domain, the ransomware assumes it’s under scrutiny, and goes dormant.<\/p>\n

\n