EternalBlue (CVE-2017-0144): The Most Dangerous Exploit in Cybersecurity History
Introduction
In the annals of cybersecurity, few vulnerabilities have achieved the notoriety and destructive impact of EternalBlue. Identified as CVE-2017-0144, this exploit targeting Microsoft’s Server Message Block (SMB) protocol became the driving force behind two of the most devastating cyberattacks in history: WannaCry and NotPetya. The exploit’s journey from a classified National Security Agency (NSA) cyber weapon to a freely available tool for cybercriminals represents one of the most significant failures in the history of cyber weapons development and vulnerability disclosure.
This article examines the complete story of EternalBlue: its origins within the NSA’s Equation Group, its dramatic leak by the Shadow Brokers hacker collective, the technical mechanics of the buffer overflow vulnerability it exploited, the catastrophic attacks it enabled, and the ongoing remediation challenges that continue to plague organizations worldwide nearly a decade later.
Part 1: The NSA Origin Story
The Equation Group and Vulnerability Development
EternalBlue was developed by what the cybersecurity community calls the “Equation Group” – a highly sophisticated advanced persistent threat (APT) actor now widely believed to be a unit within the United States National Security Agency. For years, this group was considered one of the most advanced and capable hacker organizations in the world, developing exploits that pushed the boundaries of what was technically possible.
The NSA spent nearly five years developing and refining EternalBlue. According to various reports, the agency invested significant resources into discovering bugs in Microsoft’s SMB implementation, eventually identifying the vulnerability in the srv!SrvOs2FeaListSizeToNt function that would become CVE-2017-0144.
The vulnerability existed in how Windows SMB version 1 (SMBv1) handled File Extended Attributes (FEA). When converting FEA data from OS/2 format to Windows NT format, a mathematical error caused an integer overflow that resulted in undersized buffer allocation, creating the perfect conditions for a remote code execution exploit.
The Stockpiling Dilemma
The NSA’s handling of EternalBlue exemplifies the ongoing debate about vulnerability stockpiling. Rather than immediately disclosing the vulnerability to Microsoft through a responsible disclosure process, the NSA chose to weaponize it and keep it secret for intelligence operations.
The agency maintained this stance for approximately five years, using EternalBlue in various covert operations. The exploit was considered so valuable that it became one of the “crown jewels” of the NSA’s cyber arsenal, used in countless intelligence-gathering and counterterrorism missions.
Microsoft was not informed of the vulnerability’s existence until early 2017, when the NSA discovered that EternalBlue had been stolen. This delay in disclosure would prove catastrophic, as it meant that when the exploit eventually became public, millions of systems remained vulnerable.
Part 2: The Shadow Brokers Leak
Who Are the Shadow Brokers?
The Shadow Brokers emerged in August 2016 as a mysterious hacking group that claimed to have breached the Equation Group’s systems. Their initial announcement came with a portentous message written in broken English, offering to sell ” Equation Group” tools to the highest bidder.
Over the following months, the group released several batches of exploits and tools, each more damaging than the last. The cybersecurity community watched in growing alarm as sophisticated nation-state grade capabilities were dumped into the public domain.
The April 14, 2017 Release
On April 14, 2017, the Shadow Brokers released their most damaging cache yet. Among the tools released were several sophisticated SMB exploits:
- EternalBlue – The primary exploit targeting CVE-2017-0144
- EternalRomance – Another SMB exploit targeting CVE-2017-0145
- EternalSynergy – Targeting CVE-2017-0146
- EternalChampion – Targeting CVE-2017-0147
The release also included an entire exploitation framework called “FuzzBunch,” which provided an easy-to-use interface for deploying these attacks. For the first time, even relatively unskilled attackers could leverage sophisticated nation-state level exploits.
Microsoft’s Patching Sprint
Interestingly, Microsoft had released Security Bulletin MS17-010 on March 14, 2017 – exactly one month before the Shadow Brokers release. This timing was not coincidental. The NSA had belatedly alerted Microsoft to the vulnerabilities after discovering the theft of their tools.
Microsoft’s decision to release an out-of-band patch (the February 2017 Patch Tuesday was skipped) indicates the severity with which they viewed these vulnerabilities. The MS17-010 bulletin was marked as “Critical” and addressed a family of six related CVEs:
- CVE-2017-0143
- CVE-2017-0144 (EternalBlue)
- CVE-2017-0145
- CVE-2017-0146
- CVE-2017-0147
- CVE-2017-0148
However, the window between patch release and exploit disclosure proved insufficient. Many organizations had not applied the patch when the Shadow Brokers released the actual exploit code, and even more critically, many systems remained unpatched when WannaCry struck two months later.
Part 3: Technical Analysis – How the Buffer Overflow Worked
Understanding SMBv1
The Server Message Block (SMB) protocol is a network file sharing protocol that allows applications to read and write to files and request services from server programs on a network. SMB version 1, introduced in the early days of Windows networking, remained enabled by default in Windows systems for decades due to backward compatibility requirements.
SMB operates primarily over TCP port 445 (though it can also run over ports 139 and 137). This port listens for incoming connections and is often exposed in corporate networks for file and printer sharing.
The Three Bugs That Made EternalBlue Possible
EternalBlue exploits not one but three distinct bugs in Windows SMBv1 implementation:
Bug 1: The Integer Overflow (CVE-2017-0144)
The primary vulnerability exists in the Srv!SrvOs2FeaListSizeToNt function. This function is responsible for calculating the buffer size needed when converting File Extended Attributes (FEA) from OS/2 format to Windows NT format.
The bug occurs because the function performs a calculation where a DWORD (32-bit value) is subtracted and stored into a WORD (16-bit value). When the calculation results in a value that doesn’t fit in a WORD, an integer overflow occurs, causing the system to allocate a buffer that is far too small for the data it needs to hold.
In simplified terms:
1. The attacker sends a specially crafted SMB packet with malformed FEA data
2. The server calculates the buffer size using the flawed function
3. Due to integer overflow, a small buffer is allocated
4. The actual data written far exceeds the buffer size
5. Adjacent kernel memory gets overwritten
Bug 2: Protocol Command Confusion
The second bug involves confusion between two SMB subcommands: SMB_COM_TRANSACTION2 and SMB_COM_NT_TRANSACT. These commands have different definitions for similar structures, and EternalBlue leverages this confusion to trigger the buffer overflow conditions in a way that the developers never anticipated.
Bug 3: Kernel Pool Manipulation
The third bug allows for heap spraying – a technique where attackers can allocate memory at predictable addresses in the kernel’s non-paged pool. By manipulating the kernel memory layout before triggering the overflow, attackers can ensure their malicious code ends up in the right place for execution.
The Attack Flow
The complete EternalBlue exploitation flow follows these steps:
- Reconnaissance: The attacker scans for exposed SMB port 445 on target systems
- Connection: Establish SMBv1 connection to the target
- Memory Manipulation: Send multiple
srvnetconnections to manipulate kernel pool layout - Payload Delivery: Send specially crafted transaction packets containing the malformed FEA data
- Buffer Overflow: Trigger the integer overflow causing undersized buffer allocation
- Code Execution: Overflow corrupts adjacent memory containing function pointers, diverting execution to attacker-controlled shellcode
- Privilege Escalation: Malicious code runs with kernel-level privileges, essentially owning the system
The elegance of EternalBlue lies in its ability to achieve remote code execution instantly, without requiring authentication. Simply sending the right packets to an exposed SMBv1 port gives the attacker complete control.
Why SMBv1 Made This Wormable
SMBv1’s design made it particularly suitable for worm propagation:
- Authentication Not Required: EternalBlue works without valid credentials
- Network Exposure: Port 445 commonly exposed on internal networks
- Ubiquitous Presence: SMBv1 enabled by default on virtually all Windows systems
- Kernel-Level Impact: Direct kernel memory corruption for maximum impact
- Rapid Propagation: Single packet delivery with immediate payload execution
These characteristics transformed CVE-2017-0144 from a serious vulnerability into a “wormable” threat – capable of spreading automatically across networks without human intervention.
Part 4: WannaCry – The Attack That Stopped the World
May 12, 2017: The Day Everything Changed
On Friday, May 12, 2017, cybersecurity entered a new era. A ransomware worm now known as WannaCry began spreading across the globe at unprecedented speed, leveraging EternalBlue to infect systems that had not been patched against MS17-010.
Within hours, WannaCry had infected over 200,000 computers in more than 150 countries. The attack paralyzed hospitals in the United Kingdom’s National Health Service (NHS), disrupting critical healthcare services. It hit telecommunications companies in Spain, government agencies in Russia, universities in China, and countless other organizations worldwide.
The Ransomware Component
WannaCry itself was a fairly standard ransomware – encrypting files and demanding Bitcoin payments for decryption. What made it exceptional was its propagation mechanism. Rather than relying on phishing emails or drive-by downloads, WannaCry used EternalBlue to spread autonomously.
The malware would:
1. Arrive on a system (often through an exposed SMB port)
2. Check for a “kill switch” domain
3. If the kill switch was inactive, encrypt files
4. Scan for other vulnerable systems on the network and internet
5. Propagate to new victims via EternalBlue
The Kill Switch Discovery
An accidental hero emerged in the form of Marcus Hutchins (known online as MalwareTech), a 22-year-old British security researcher. While analyzing WannaCry, Hutchins discovered that the malware checked for a specific domain name before executing. If the domain existed and resolved, the malware would stop.
The domain was unregistered. Hutchins registered it for approximately $10, inadvertently activating the kill switch and halting the global spread of WannaCry. This action is credited with preventing potentially millions of additional infections.
The Damage Assessment
The total cost of WannaCry is estimated at over $4-8 billion globally, though exact figures remain difficult to calculate. The attack demonstrated:
- Critical infrastructure vulnerability (hospitals, utilities)
- Global interconnectivity risks
- The danger of unpatched systems
- The catastrophic potential of combined exploits (ransomware + worm)
Part 5: NotPetya – Cyber Warfare Disguised as Ransomware
June 27, 2017: The Real Cyber War Begins
Six weeks after WannaCry, an even more devastating attack struck. On June 27, 2017, NotPetya began spreading, primarily targeting Ukrainian organizations before rapidly expanding globally.
Unlike WannaCry, NotPetya was never really ransomware. While it displayed a ransom demand, its true purpose was destruction. The malware irreversibly encrypted victim hard drives, destroying data with no intention or capability for recovery.
The Initial Attack Vector
NotPetya used multiple propagation methods:
- EternalBlue: For lateral movement across networks
- Compromised Software Update: Attackers had infiltrated M.E.Doc, a Ukrainian accounting software company, and distributed NotPetya through a malicious software update
- Credential Theft: Tools like Mimikatz were used to extract passwords from infected systems
Corporate Casualties
NotPetya’s impact on global corporations was staggering:
Maersk: The Danish shipping giant, which handles approximately one-fifth of global shipping, saw its operations completely paralyzed. Ports worldwide couldn’t process cargo. The company lost an estimated $250-300 million and required 10 days of around-the-clock work by 600 IT personnel to rebuild their network.
Merck: The pharmaceutical giant suffered significant disruptions to manufacturing and distribution, with estimated losses of $670 million.
FedEx/TNT: TNT Express, FedEx’s European subsidiary, saw operations disrupted for months, with estimated losses exceeding $400 million.
Other Victims: Mondelēz, Reckitt Benckiser, Saint-Gobain, and numerous other global corporations each suffered losses in the hundreds of millions.
Attribution and Geopolitical Implications
Unlike WannaCry, which appeared to be cybercrime, NotPetya was quickly attributed to state actors. Multiple intelligence agencies and cybersecurity firms attributed the attack to Russian military intelligence (GRU), specifically the Sandworm group.
The attack was designed to target Ukraine but used Ukraine-based companies as a launchpad to attack globally. The indiscriminate use of wormable exploits like EternalBlue meant collateral damage extended far beyond the intended targets.
The $10 Billion Price Tag
By January 2018, the total cost of NotPetya was estimated at over $10 billion, making it the single most financially damaging cyberattack in history at that time. The White House officially designated it as the “most destructive and costly cyber-attack in history.”
Part 6: Remediation – Protecting Against EternalBlue
The Fundamental Fix: MS17-010
Microsoft’s MS17-010 security update remains the primary defense against EternalBlue. The patch corrects the buffer overflow calculation in the Srv!SrvOs2FeaListSizeToNt function, ensuring that buffer sizes are calculated correctly regardless of the input data.
The related Knowledge Base articles include:
– KB4012212 (Windows Server 2008)
– KB4012213 (Windows 7)
– KB4012214 (Windows 8.1)
– KB4012215 (Windows Server 2012 R2)
– KB4012216 (Windows Server 2012)
– KB4012217 (Windows Server 2008 R2)
Modern Windows versions (Windows 10, Windows Server 2016, 2019, 2022) include these fixes in their base installations and receive ongoing updates through cumulative updates.
The Kill Switch: Disable SMBv1
The most effective mitigation is to completely disable SMBv1. Since EternalBlue specifically targets SMBv1, disabling this legacy protocol eliminates the attack vector entirely.
PowerShell Commands to Disable SMBv1:
# Check SMBv1 status
Get-WindowsFeature FS-SMB1
# Disable SMBv1 Server (Windows Server 2012 R2 and above)
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
# Or remove the feature entirely
Remove-WindowsFeature FS-SMB1
# Disable SMBv1 Client
sc.exe config lanmanworkstation start=disabled
Registry Method (Windows 7/2008 R2 and above):
HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
Value: SMB1
Type: REG_DWORD
Data: 0
Group Policy Deployment:
For enterprise environments, Group Policy provides centralized control:
- Navigate to: Computer Configuration > Administrative Templates > Network > Lanman Server
- Enable: “SMB 1.0/CIFS Server Settings”
- Set to: Disabled
Network Segmentation
Proper network segmentation limits the blast radius of wormable exploits:
- Block TCP port 445 at all firewalls (perimeter and internal)
- Implement strict VLAN segmentation
- Use microsegmentation to limit east-west traffic
- Apply the principle of least privilege to network access
Detection Commands
Nmap Scan for Vulnerable Systems:
# Basic SMB scan
nmap -p 445 --script smb-vuln-ms17-010 <target_network>
# More comprehensive scan
nmap -p 445,139 -sV --script smb-vuln-ms17-010,vuln <target_network>
# Fast scan of common ports
nmap -sV -p 445 --script smb-protocols,smb-vuln-ms17-010 <target_range>
Metasploit Detection Module:
msfconsole
use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS <target_network>
run
PowerShell Local Verification:
# Check if SMBv1 is enabled
Get-SmbServerConfiguration | Select EnableSMB1Protocol
# Check for MS17-010 hotfixes
Get-HotFix | Where-Object {$_.HotFixID -match "KB4012212|KB4012215|KB4012213|KB4012216|KB4012214|KB4012217"}
# Alternative registry check
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" -Name SMB1
Nessus/OpenVAS Scan:
Both Nessus and OpenVAS include plugins specifically checking for MS17-010:
– Nessus Plugin ID: 99539
– OpenVAS OID: 1.3.6.1.4.1.25623.1.0.108007
Remediation Priority Matrix
| Status | Risk Level | Action Required |
|---|---|---|
| Unpatched + SMBv1 Enabled | CRITICAL | IMMEDIATE patching or isolation |
| Patched + SMBv1 Enabled | HIGH | Disable SMBv1 |
| Unpatched + SMBv1 Disabled | MEDIUM | Apply MS17-010 |
| Patched + SMBv1 Disabled | LOW | Maintain current state |
Part 7: Why Systems Remain Vulnerable Today
The Persistence of Legacy Systems
Despite MS17-010 being available since March 2017, EternalBlue exploitation remains a significant threat in 2024 and beyond. Several factors contribute to this persistent vulnerability:
End-of-Life Operating Systems:
Windows XP, Windows Server 2003, and Windows Server 2008 reached end-of-life before or shortly after MS17-010’s release. Organizations still running these systems cannot apply standard patches and remain permanently vulnerable. Many critical infrastructure systems, industrial control systems, and specialized medical devices continue running on these deprecated platforms.
The “Fix It Later” Mentality:
Many organizations defer patching due to:
– Fear of service disruption
– Limited maintenance windows
– Lack of rollback capabilities
– Insufficient IT staffing
– Competing priorities
Hidden SMB Exposure:
Organizations may believe SMB is not exposed, but:
– Shadow IT may expose services unknown to security teams
– VPN misconfigurations can expose internal services externally
– Cloud migrations may inadvertently expose ports
– Third-party vendor access requirements may mandate SMB access
The Medical Device Dilemma
Medical devices represent a particularly challenging problem. Many devices:
– Run older Windows versions
– Cannot be patched without vendor certification
– Have FDA approval requirements for software changes
– Cost millions to replace
– Directly impact patient care if disrupted
Siemens, for example, issued advisories for ultrasound equipment that remained vulnerable to EternalBlue, illustrating how medical devices remain exposed even years after patches became available.
Industrial Control Systems
Supervisory Control and Data Acquisition (SCADA) systems and Industrial Control Systems (ICS) often run:
– Windows XP-based HMIs
– Embedded Windows versions with custom configurations
– Systems requiring extended vendor validation before any changes
These systems control critical infrastructure including power grids, water treatment facilities, and manufacturing plants – making them high-value targets while simultaneously making patching extremely difficult.
Shadow Brokers Legacy: Continued Exploitation
The Shadow Brokers leak created a permanent democratization of nation-state level cyberweapons. Criminal organizations, hacktivists, and other nation-states all gained access to sophisticated exploits:
- BlueKeep (CVE-2019-0708): Similar remote code execution vulnerability in Remote Desktop Services, used similar wormable propagation
- Sig Владеет (Sigwin) attacks: Continued exploitation of EternalBlue-related vulnerabilities
- Ransomware groups: Multiple ransomware families incorporated EternalBlue for lateral movement
The Eternal Variants
Security researchers have developed additional tools based on the leaked exploits:
EternalRocks: Dubbed “a more dangerous WannaCry” by some researchers, this worm incorporated up to seven NSA exploits from the Shadow Brokers leak, though it didn’t carry a destructive payload.
SMBdoor: A backdoor inspired by EternalBlue with enhanced stealth capabilities, demonstrating that the original vulnerability continues to inspire new attack development.
Financial Impact Beyond Direct Attacks
Organizations continue paying for EternalBlue-based attacks in multiple ways:
– Ransomware payments (though not always successful)
– Recovery and remediation costs
– Business interruption losses
– Regulatory fines for non-compliance
– Reputation damage
– Legal liability
Insurance claims and premium increases related to EternalBlue-based attacks continue to cost organizations indirectly.
Part 8: Lessons Learned and the Path Forward
Policy Implications: The Vulnerability Stockpiling Debate
EternalBlue fundamentally changed the vulnerability disclosure debate. Microsoft’s president Brad Smith publicly criticized the NSA’s practice of stockpiling vulnerabilities rather than disclosing them, calling for a “Digital Geneva Convention” to govern nation-state behavior in cyberspace.
The key policy lessons include:
Vulnerabilities Don’t Stay Secret Forever:
The NSA assumed EternalBlue would remain secret indefinitely. The Shadow Brokers proved that even the most sophisticated intelligence agencies can have their tools stolen and exposed. This reality demands reconsideration of vulnerability retention policies.
Responsible Disclosure Protects Everyone:
Had the NSA disclosed the SMBv1 vulnerabilities when first discovered, years of potential exploitation would have been prevented. The intelligence benefit of retaining the vulnerability must be weighed against the risk of eventual exposure.
Dual-Use Technology Dilemma:
Cyber weapons like EternalBlue exemplify the dual-use problem – the same vulnerabilities used for legitimate intelligence gathering can be turned against the nation that developed them. Attackers only need to find one vulnerability; defenders must secure them all.
Technical Lessons
Legacy Protocol Deprecation:
SMBv1 should have been deprecated decades ago. Its continued presence in default Windows installations created an attack surface that enabled EternalBlue. Organizations must regularly review and eliminate legacy protocols.
Defense-in-Depth:
Organizations relying solely on patching as their defense were devastated. Effective security requires multiple layers:
– Network segmentation
– Endpoint detection and response (EDR)
– Intrusion detection/prevention systems
– Proper firewall rules
– Regular vulnerability scanning
Incident Response Matters:
Organizations with mature incident response capabilities recovered faster and suffered less damage. The ability to quickly identify, isolate, and remediate infected systems proved crucial.
Regulatory Response
EternalBlue and the subsequent attacks contributed to:
U.S. Federal Legislation:
– CISA (Cybersecurity and Infrastructure Security Agency) Act of 2018
– Increased federal requirements for vulnerability disclosure
– Modernizing government IT systems
International Coordination:
– Enhanced cooperation for attribution
– Joint advisories when vulnerabilities are disclosed
– International legal frameworks for cybercrime
Industry Standards:
– NIST Cybersecurity Framework implementations
– Increased emphasis on vulnerability management
– Third-party risk assessments
The Future: EternalBlue’s Enduring Legacy
EternalBlue has become a permanent fixture in the cybersecurity landscape. Security researchers ported the exploit to all Windows versions since Windows 2000, demonstrating that vulnerability knowledge persists indefinitely.
Even as organizations patch existing systems, new risks emerge:
– Internet of Things (IoT) devices running Windows-like OS
– Embedded systems in critical infrastructure
– Cloud environments with legacy compatibility
– Supply chain vulnerabilities in third-party software
The exploit’s continued availability ensures it will remain in attacker toolkits for years to come.
Conclusion: The Indelible Mark of EternalBlue
EternalBlue represents a watershed moment in cybersecurity history. It demonstrated that a single vulnerability, when weaponized and leaked, can cause billions of dollars in damages, disrupt critical infrastructure across continents, and fundamentally reshape how organizations think about security.
The exploit’s journey from classified NSA tool to criminal weapon exemplifies the risks of vulnerability stockpiling. The NSA’s five-year retention of this knowledge, rather than responsible disclosure, directly contributed to the conditions that enabled WannaCry and NotPetya to cause such catastrophic damage.
From a purely technical perspective, EternalBlue is a masterpiece of exploitation engineering. The combination of integer overflow, protocol confusion, and kernel pool manipulation demonstrates sophisticated understanding of Windows internals. Yet this sophistication was turned against the systems it was meant to protect.
The ongoing persistence of vulnerable systems, despite patches being available for years, highlights the challenges of modern security. Legacy systems, operational constraints, resource limitations, and competing priorities all contribute to an environment where even the most widely publicized vulnerabilities continue to find victims.
Key Takeaways for Security Practitioners
Patch management is non-negotiable: Organizations must have processes to apply critical security updates rapidly, especially for wormable vulnerabilities.
Eliminate legacy protocols: SMBv1, NTLM, and other deprecated protocols should be disabled everywhere possible.
Segment networks properly: Limit lateral movement opportunities through proper network segmentation.
Assume breach: Design systems assuming attackers will get in; detection and response matter as much as prevention.
Monitor continuously: Continuous vulnerability scanning and threat monitoring are essential in modern environments.
Key Takeaways for Policy Makers
Vulnerability stockpiling carries systemic risk: Agency retention policies must account for eventual exposure.
Coordinated vulnerability disclosure serves national security: Agencies should bias toward disclosure unless overriding national security concerns exist.
Critical infrastructure requires special protection: The vulnerability of hospitals, utilities, and other critical services demands enhanced security requirements.
International norms need development: The absence of clear international rules for cyber operations increases risk for everyone.
Final Thoughts
EternalBlue’s name has proven prophetic – the vulnerability truly does seem “eternal” in its impact. Seven years after its public disclosure, it continues to threaten organizations worldwide. The fundamental lesson is clear: in cybersecurity, there are no perfect secrets, no permanent protections, and no substitutes for vigilance.
The Shadow Brokers leak transformed what was arguably the NSA’s most valuable cyber weapon into a global security menace. The resulting attacks destroyed billions in value, disrupted countless lives, and fundamentally changed the cybersecurity landscape. No organization can afford to ignore the lessons EternalBlue taught.
Whether the next EternalBlue comes from another Shadow Brokers-style leak, from independent security research, or from sophisticated attack development, the cybersecurity community must be ready. Patch promptly. Disable legacy systems. Segment networks. Monitor continuously. And never assume that what is secret today will remain secret tomorrow.
Timeline Summary:
| Date | Event |
|---|---|
| ~2012 | NSA discovers and develops EternalBlue |
| 2012-2017 | NSA uses EternalBlue in operations |
| August 2016 | Shadow Brokers emerge, begin leaking Equation Group tools |
| March 14, 2017 | Microsoft releases MS17-010 (after NSA warning) |
| April 14, 2017 | Shadow Brokers release EternalBlue publicly |
| May 12, 2017 | WannaCry attack begins |
| May 12, 2017 | Kill switch discovered and activated |
| June 27, 2017 | NotPetya attack begins |
| 2018+ | EternalBlue continues to appear in attacks globally |
Word Count: ~4,100 words
This article is intended for educational purposes. The vulnerabilities and exploits described are historical in nature, related patches have been available since 2017, and understanding these events remains important for cybersecurity education and awareness.
