EternalChampion is one of the handful of “exploitation tools” leaked by a group called The Shadow Brokers (TSB) that take advantage of weaknesses in how Windows implemented the Server Message Block (SMB) protocol. EternalChampion particularly exploits a race condition in how SMB handles a transaction. TrickBot is an infamous banking Trojan known to use EternalChampion to spread laterally. More information can be found in our blogs: TrickBot takes over as top business threat and How threat actors are using SMB vulnerabilities.