EternalBlue, WannaCry & NotPetya (MS17-010)

EternalBlue is an exploit for a flaw in SMBv1, the old Windows file-sharing protocol on port 445. One crafted packet overflows a buffer and runs code on the target, with no login. It was an NSA exploit that a group called the Shadow Brokers leaked in April 2017, a month after Microsoft had already shipped the fix, MS17-010.

Attackers turned it into worms within weeks. On 12 May 2017, WannaCry ransomware hit more than 200,000 systems in 150 countries and disrupted over a third of NHS trusts in England, cancelling thousands of appointments. On 27 June, NotPetya arrived through a hijacked update of M.E.Doc, Ukrainian tax software, and used EternalBlue to spread inside networks. It looked like ransomware but was a wiper: files could not be recovered. The US, UK and others blamed Russia, and a White House assessment put the total damage above $10 billion; Maersk alone estimated $200–300 million in lost revenue.

The patch had been out for about two months before WannaCry. What failed was the basics: unpatched and unsupported Windows, SMB reachable far more widely than needed, and flat networks with nothing to stop a worm. The lessons still hold: patch protocols that let attackers move between machines quickly, turn off SMBv1, segment networks, and keep offline backups.