Navy Marine Corps Intranet hit by Welchia worm

About three-quarters of the Navy Marine Corps Intranet has lost network capacity due to an infestation by the Welchia worm (also called Nachi), according to Navy sources.

About three-quarters of the Navy Marine Corps Intranet has lost network capacity due to an infestation by the Welchia worm (also called Nachi ), according to Navy sources. First seen Monday, the Welchia worm attempts to eradicate the Blaster worm, which spread to millions of Windows-based machines last week.

The Welchia worm, which exploits the same Remote Procedure Call (RPC) vulnerability as Blaster – as well as what’s called the WebDAV vulnerability in unpatched Windows-based machines – spreads by scanning for new machines to infiltrate, just as Blaster does.

The Welchia worm has infected an unspecified number of computers within the Navy Marine Corps Intranet, which has about 100,000 users. This has caused the NMCI, which is managed on an outsourced basis by Electronic Data Systems, to become congested to the point it cannot presently be useful for network connections.

Navy personnel can still use their desktop PCs to do work, but the LAN-based NMCI is not fully functional due to this scanning congestion caused by Welchia, noted Navy spokeswoman Nicolle Rose. The Navy expects to issue more details about the situation shortly as it tracks down the worm infestation to eliminate it. The Navy wasn’t infected with the Blaster worm last week, Rose noted.