The attack is called bad tunnel I Have been in contact with VPN company's as all there windows servers (all versions of windows from W95 to W10) are getting a attack throw ports 135, 136, 137, 138, 139, 455, 500 but mainly port 137 dew to them running windows under windows 10 anniversary update.
BadTunnel exploits a series of security weaknesses, including how Windows resolves network names and accepts responses; how IE and Edge browsers support webpages with embedded content; how Windows handles network paths via an IP address; how NetBIOS Name Service NB and NBSTAT queries handle transactions; and how Windows handles queries on the same UDP port (137) – all of which when lumped together make the network vulnerable to a BadTunnel attack.
Here’s an attack scenario, as explained in Yu’s technical paper:
1. Alice and Bob can be located anywhere on their network, and have firewall and NAT devices in-between, as long as Bob’s 137/UDP port is reachable by Alice.
2. Bob closes 139 and 445 port, but listens on 137/UDP port.
3. Alice is convinced to access a file URI or UNC path that points to Bob, and another hostname based URI such as “http://WPAD/x.jpg” or “http://FileServer/x.jpg”. Alice will send a NBNS NBSTAT query to Bob, and also send a NBNS NB query to the LAN broadcast address.
4. If Bob blocks access to 139 and 445 port using a firewall, Alice will send a NBNS NBSTAT query after approximately 22 seconds. If Bob instead closed 139 and 445 port by disabling Server Windows service or NetBIOS over TCP/IP protocol, Alice do not need to wait for connection to time out before send the query.
info taken from this page: https://goo.gl/OZnC9b
Here is a google search if you want to read up on it more: https://goo.gl/ZTNH26
