Honeynet Field Notes, Day 2: WannaCry Is Still Working Port 445
·1445 words·7 mins
The second pull from the honeynet surfaced a 2017-era WannaCry launcher delivered through DoublePulsar, more than 14,000 EternalBlue sessions from two hosts, and an attacker who planted an SSH key to reach back out to their own infrastructure.