DoublePulsar

DoublePulsar
Name	DoublePulsar
Developer	Unknown/Equation Group (attribution disputed)
Released	2017 (disclosed)
Programming language	x86 shellcode
Operating system	Microsoft Windows
Genre	Backdoor, rootkit, espionage tool

DoublePulsar.

DoublePulsar was a covert backdoor implant discovered in leaked cyberweapons associated with the Equation Group and publicly disclosed during the 2017 Shadow Brokers revelations. The implant targeted Microsoft Windows kernel interfaces, enabling remote command execution and persistence on compromised hosts; its disclosure intersected with investigations by National Security Agency, Microsoft Corporation, Kaspersky Lab, Symantec Corporation, and multiple national cybersecurity agencies. Attribution and operational history invoked debates among analysts at Mandiant, FireEye, Citizen Lab, Council on Foreign Relations, and independent researchers.

Background and Discovery

The implant came to light amid the 2016–2017 leak known as the Shadow Brokers dump, a sequence of disclosures that also implicated tools linked to the Equation Group and raised scrutiny from United States Department of Defense, United States Department of Homeland Security, United Kingdom National Cyber Security Centre, Australian Signals Directorate, and industry responders. Initial analysis by Kaspersky Lab and reverse engineers at Symantec Corporation and F-secure tied the payload to exploits used alongside the Eternal family, which referenced vulnerabilities disclosed by Microsoft Corporation in MS17-010; public reporting involved outlets such as The New York Times, Wired, and Ars Technica that covered the leak alongside commentary from researchers at Google Project Zero and Citizen Lab. Legal and policy debates followed in forums including United States Congress hearings, discussions at DEF CON and Black Hat USA, and analyses by think tanks like Brookings Institution and RAND Corporation.

Architecture and Operation

DoublePulsar operated as a kernel-mode implant that hooked Windows kernel callbacks and invoked shellcode through a triad of commands: ping, kill, and run; analysts mapped its interfaces to export calls that leveraged Windows kernel APIs traced in Microsoft debugging symbols and Windows internals documented by Mark Russinovich and David Solomon. The implant used SMB and NT kernel mechanisms analogous to EternalBlue usage, interacting with components in Microsoft Windows Server 2008 R2, Microsoft Windows 7, Microsoft Windows Server 2003, and other supported editions affected by MS17-010; reverse engineering reports from Kaspersky Lab, Symantec Corporation, and researchers at ESET and CrowdStrike detailed memory-resident payloads, I/O control request handling, and x86 shellcode sequences. Analysts compared DoublePulsar's persistence techniques with earlier implants attributed to the Equation Group and described implications for system internals referenced in documentation by Microsoft Developer Network and presentations at REcon.

Exploitation and Malware Capabilities

Combined with exploit families like EternalBlue and EternalRomance, DoublePulsar provided a staging ground for widespread malware campaigns; prominent payloads delivered through the implant included ransomware and worms exemplified by WannaCry, NotPetya, and other commodity malware linked to criminal and state-aligned operations. Technical capabilities included remote code execution, arbitrary payload injection, and kernel-mode command execution that enabled lateral movement observed in incidents investigated by Europol, FBI, Interpol, and corporate responders at Microsoft Corporation and Cisco Talos. Malware attribution and campaign analysis invoked actors such as Lazarus Group and state actor assessments published in reports by UK National Cyber Security Centre and United States Cyber Command, though attribution remained contested across Cybersecurity and Infrastructure Security Agency advisories and independent research.

Detection and Forensic Analysis

Forensic work to detect DoublePulsar centered on memory forensics, kernel object inspection, and network indicators tied to SMB negotiation patterns; practitioners used tools and frameworks from Volatility Project, Rekall, Wireshark, Sysinternals, and FTK Imager to extract indicators of compromise. Signatures and YARA rules were produced by analysts at Kaspersky Lab, Symantec Corporation, ESET, CrowdStrike, and Mandiant and distributed via advisories from Microsoft Security Response Center and US-CERT; detection guidance referenced artifacts such as anomalous kernel callbacks, undocumented exported functions, and particular SMB packet fingerprints discussed at conferences like SANS Institute and Black Hat USA. Incident responders coordinated containment playbooks with guidance from CERT Coordination Center and interoperability testing by industry consortia including FIRST.

Impact and Incidents

The publicized leak and subsequent weaponization led to multiple high-profile incidents, most notably the 2017 WannaCry ransomware outbreak and the NotPetya disruption, which affected organizations including National Health Service (England), Maersk, Merck & Co., DLA Piper, and governmental agencies in Ukraine and beyond. Economic and operational impacts were analyzed by Robert Mueller-era investigations, insurers like Aon, and economic research conducted by IHS Markit and Economist Intelligence Unit; legal and regulatory responses involved filings and advisories from European Union Agency for Cybersecurity, United States Securities and Exchange Commission, and national legislative bodies. The incidents intensified debates in venues such as United Nations General Assembly forums on norms of state behavior in cyberspace and prompted strategy updates at NATO cyber defense bodies.

Mitigation and Patch History

Microsoft released bulletins and security updates addressing the exploited vulnerabilities in MS17-010 and published mitigations and detection tools through Microsoft Security Response Center and the Microsoft Update Catalog; coordinated disclosure and emergency patching efforts involved alerts from US-CERT, CERT-EU, and vendor advisories from Trend Micro and Sophos. Long-term mitigation included deployment of SMBv1 deprecation guidance, network segmentation strategies discussed in NIST publications and ISO/IEC 27001-aligned frameworks, and adoption of endpoint detection and response platforms by organizations such as IBM Security, Splunk, Palo Alto Networks, and CrowdStrike. Post-incident policy reforms referenced in white papers from Center for Strategic and International Studies and Atlantic Council emphasized vulnerability disclosure processes, stockpiling debates, and international norms addressed in multilateral fora including Group of Seven discussions and OSCE cyber dialogues.

Category:Computer security