Cryo Virus

Today we had a customer whose server was infected by WannaCry (or similar crypto-virus).
We think that the infection has succeeded using his RDP saved connection to the server by getting it and installing itself.

 

As all the ports on the servers are closed by a firewall it will not affect any other servers.

BUT In order to keep all the other servers in our network safe, we will apply the latest updates out of the normal schedule and will restart all the windows servers that are managed.

There is a vulnerability that allows WannaCry to get into all the other machines within the same IP segment using the SMP ports. 

If you dont have managed service you can use this little program to check your server 

http://support.eset.com/alert6442/#eternalblue 

 

Please also keep your computers with saved RDP connections save or just clear the credentials.

 

Stay safe

ABAKOMP Support