Indexsinas SMB worm is targeting Windows servers vulnerable to EternalBlue

Security researchers have warned of a new campaign dubbed Indexsinas that breaches networks through SMB servers and makes aggressive use of lateral movement to propagate. The worm, also known as NSABuffMiner, has been around since 2019 and targets Windows servers vulnerable to EternalBlue (MS17-010).

Natalie Page, a threat intelligence analyst at Talion, told IT Pro that Indexsina’s use of lateral movement is troublesome and highlights the importance of segmenting a network to prevent an attacker from reaching the ‘crown jewels’ of a network.