NotPetya malware ’absorbed NSA exploit six months before they were made public’

THE TWO US NATIONAL SECURITY AGENCY (NSA) exploits used by the NotPetya malware were allegedly absorbed into its code in February before they were even publicly released by the Shadow Brokers group.That’s according to research released by Andy Patel, security advisor at F-Secure. He described the code as both ”a mess… part of it most certainly isn’t sophisticated. But… part of it is”.Two of three main components he describes as ”shoddy”, but ”the third component, the bit that allows the malware to spread laterally across networks, seems very sophisticated and well-tested”.That is the part that incorporates the NSA exploits. He continued: ”It appears to be well designed, well tested, and there’s evidence that development on the network propagation component was completed in February.”February is many weeks before the exploits EternalBlue and EternalRomance (both of whoch this module utilises) were released to the public (in April) by the Shadow Brokers. And those exploits fit this component like a glove.”However, he cautioned: ”This isn’t rock solid evidence, but it’s far more compelling to us than any of the other reasoning we’ve seen so far.”

Källa: NotPetya malware ’absorbed NSA exploit six months before they were made public’