EternalBlue and WannaCry: When an NSA Exploit Crippled the World

Imagine that the world’s most powerful intelligence agency has kept a master key in a safe for years - a tool capable of opening hundreds of millions of computers across the planet. Now imagine that key is stolen and published on the Internet for free. You don’t have to imagine - it really happened in 2017. The tool was called EternalBlue, and its leak led to one of the most devastating attacks in history. This is a story about what happens when a cyberweapon slips out of its creator’s hands.

The safe that leaked

For years, the US National Security Agency (NSA) had been collecting software vulnerabilities - unknown vulnerabilities that allowed it to break into systems for intelligence purposes. One of the jewels in this crown was EternalBlue: an exploit that exploited a bug in the SMBv1 (file sharing) protocol on Windows systems. It allowed you to remotely take over a vulnerable machine without any user interaction - you didn’t have to force anyone to click. It was enough that the computer was available on the network.

In the spring of 2017, a mysterious group called Shadow Brokers released a massive set of tools stolen from the NSA — including EternalBlue. In an instant, state-grade weapons became available to everyone: criminals, script kiddies, hostile intelligence services. The clock started ticking.

Microsoft did — but the world didn’t listen

There is a detail in this story that makes it even more bitter. Microsoft released a patch for this vulnerability (MS17-010) back in March 2017 — a few weeks before the disaster. Probably warned that the tool might leak, he prepared a fix before the worst happened.

And yet, when the attack came, it paralyzed hundreds of thousands of machines. Why? Because patching in practice is slow and chaotic. Organizations postpone updates for fear of downtime, they don’t know what they have on the network, they maintain outdated systems that “cannot be touched”. This gap between “the patch exists” and “the patch is deployed” has proven fatal. This is still one of the most important lessons of vulnerability management.

May 12, 2017: WannaCry Strikes

On Friday, May 12, the world woke up to a nightmare. Malware called WannaCry was spreading across the planet at a rate not seen in a decade. It combined two things into an explosive whole:

• Ransomware - encrypted files on the attacked computer and demanded a ransom in bitcoin.
• Worm Ability - Thanks to EternalBlue, it spread itself, from machine to machine, without human intervention. One susceptible computer on the network was enough to infect others.

The effect was avalanche. Within hours, WannaCry had hit over 200,000 computers in approximately 150 countries. In Great Britain, it paralyzed some National Health Service systems - surgeries were canceled, ambulances were directed to other hospitals, doctors lost access to patient records. Factories, telecoms, railways and offices suffered. For the first time, a cyber attack on such a scale translated directly into physical, human consequences.

An accidental hero and a kill switch

In the middle of the chaos, a young British researcher, known online as MalwareTech, was analyzing a WannaCry sample and noticed something strange: the code was trying to connect to some pointless, unregistered domain before starting encryption. Following his intuition, he registered this domain - it cost him several dollars.

It turned out that he hit a kill switch built into the malware: until the domain responded, WannaCry encrypted; when it suddenly started responding, the malware “believed” it was in an analysis environment and terminated its operation. One domain registration stopped the global wave of infections. This is one of the most extraordinary moments in the history of cybersecurity - the world was saved by the accident and vigilance of one man.

Who was behind WannaCry

Investigations and analysis attributed WannaCry to the Lazarus Group, which is affiliated with North Korea. The motive appeared to be financial, although the actual bitcoin proceeds were surprisingly low given the scale of destruction - the attack was sloppy rather than precise. This contrasts with the surgical Stuxnet: WannaCry sought money and publicity, while global disruption became a side effect of primitive but self-replicating code powered by a stolen exploit.

Why this story is so important

WannaCry and EternalBlue provided a lesson that shaped the modern approach to security:

• State stockpiling vulnerabilities is risky for everyone. Weapons intended for intelligence purposes can leak and hit civilians - hospitals, factories, ordinary people. This is a real argument in the debate about whether services should disclose vulnerabilities to manufacturers.
• Patching saves lives - literally. The patch has been in place for two months. Organizations that implemented it came through the storm dry. This is the clearest proof that timely updates are not bureaucracy but frontline defense.
• SMBv1 and outdated protocols are time bombs. Old, unnecessary services maintained “because they work” are perfect fuel for worms.

Lessons for companies - still relevant

Even though years have passed, the exact same errors are responsible for most successful ransomware attacks today:

• Patch quickly and prioritize. Not all at once, but critical, remotely exploitable vulnerabilities - immediately. You need a process for this, not good intentions.
• Know what you have. You can’t secure a system you’ve forgotten about. Inventorying and scanning the attack surface is essential - our free scanner] helps with this.
• Segment the network. A worm like WannaCry thrives on flat networks, where one infected host can see all the others. Segmentation limits reach.
• Disable what you don’t use. Outdated protocols (like SMBv1) and unused services are an unnecessary attack surface.
• Have ransomware-resistant backups. Once encryption is successful, a good 3-2-1 backup strategy determines whether you recover in a day or pay the ransom. More about defense in ransomware: how to defend yourself.

Summary

EternalBlue and WannaCry is the story of how one agency’s cyberweapon, once unleashed, turned against the entire world - crippling hospitals and factories in 150 countries even though the patch had been in place for two months. It is also a story about vigilance: the global wave was stopped by one registered domain and the intuition of a young researcher. The most important lesson is both the simplest and most often ignored: the gap between “the fix exists” and “the fix is ​​implemented” can be deadly. The same negligence – lack of patching, flat networks, dead protocols – still fuels ransomware today.

Want to check if your infrastructure has an “EternalBlue” today - an unpatched, remotely exploitable vulnerability? Contact us - penetration testing and audits show these exact paths.

Frequently asked questions (FAQ)

What is the difference between EternalBlue and WannaCry? EternalBlue is an exploit - a tool that exploits a specific vulnerability in the Windows SMBv1 protocol to remotely take over a machine. WannaCry is ransomware that used EternalBlue as a propagation mechanism. EternalBlue was the weapon, WannaCry was the missile that launched the weapon around the world.

Could WannaCry happen again today? This exact attack - no, because the vulnerability has been patched since 2017 and SMBv1 is disabled by default. But there is a mechanism: new ransomware worms exploiting fresh, unpatched vulnerabilities appear regularly. The defense recipe remains the same - fast patching, segmentation and backups.

How did one man stop a global domain registration attack? WannaCry had a built-in kill switch: it checked whether a specific domain was responding before encrypting it. Until it existed, the malware ran; when the researcher recorded her and she started responding, the code took it as a signal to stop. It was probably an anti-analytical mechanism that turned against the creators.

Why didn’t organizations implement the patch if it existed? Because patching in large organizations is difficult: updates are postponed for fear of downtime of critical systems, there is no full knowledge of what is on the network, and outdated machines can be “intouchable”. This gap between patch availability and implementation is still the primary cause of successful attacks today - which is why vulnerability management must be a process, not an action.