Quote:The first attacks that exploit the zero-day Windows vulnerability install cryptominers and scan for targets rather than a worm with WannaCry potential.

The wave of BlueKeep attacks that security experts predicted could take down systems globally have arrived, but they are not in showing the form nor the destructive impact experts initially feared.
 
So far, BlueKeep has not lived up to this promise, nor has the vulnerability surfaced in the form of a worm. Instead, initial attacks install a cryptocurrency miner on an infected system, using processing power to generate cryptocurrency, according to reports.

Moreover, instead of a worm that moves automatically and spreads quickly, attackers instead leveraged the vulnerability’s connective capability to scan the Internet for vulnerable machines to exploit, researchers said.

British cybersecurity expert Kevin Beaumont Tweeted about the first wave of attacks Sunday after noticed that a series of Remote Desktop Protocol (RDP) honeypots—or machines set up as malware bait to help researchers detect and analyze outbreaks—started simultaneously crashing.