EternalBlue
EternalBlue is a leaked NSA-developed Windows SMBv1 remote code execution exploit associated with MS17-010 and CVE-2017-0144. It targets vulnerable Windows systems, particularly versions prior to Windows 8 and pre-Windows 10 systems, by abusing flaws in the SMBv1 implementation in srv.sys. The exploit was publicly released by The Shadow Brokers on 2017-04-14 in the "Lost in Translation" leak and is frequently described in the content as a family or collection of Windows zero-day vulnerabilities. Its capabilities include unauthenticated compromise of vulnerable hosts, kernel-level code execution, lateral movement across networks, and wormable self-propagation. Technical analysis in the content states that EternalBlue uses crafted SMB transactions and heap grooming to trigger a non-paged pool overflow and overwrite srvnet-related kernel structures, enabling execution of payloads such as DoublePulsar.
The exploit became widely known because it was repurposed in major destructive and ransomware outbreaks including WannaCry, NotPetya, and Bad Rabbit. In WannaCry, EternalBlue was used for initial SMB exploitation and was paired with the DoublePulsar backdoor to install and execute the ransomware payload while scanning TCP port 445 and propagating across internal and external networks. NotPetya also used EternalBlue for rapid spread, contributing to global damage after initially targeting Ukraine. The content also states that EternalBlue was reportedly used to spread ransomware in Baltimore, was used by the Blackmoon/KRBanker campaign’s spreader alongside DoublePulsar and EternalRomance, and has been obtained or used by actors including BackdoorDiplomacy and Buckeye/APT3. The leak and subsequent abuse of EternalBlue are repeatedly cited as examples of how stockpiled offensive cyber capabilities can escape into criminal and state-linked operations.
High-confidence indicators and associations mentioned in the content include SMBv1, MS17-010, CVE-2017-0144, TCP port 445 scanning, pairing with DoublePulsar, and public exploit implementations in Metasploit. A vulnerable system may be identified as susceptible to the MS17-010 EternalBlue attack by scanners such as Nessus. Microsoft released patches for the underlying SMB vulnerabilities in March 2017 under MS17-010.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
By using the Nessus vulnerability scanner, a system vulnerable to the MS17–010 Eternalblue attack was discovered.
CVE-2017-0143 Vulnerable Products: Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 Associated Malware: Multiple using the EternalSynergy and EternalBlue Exploit Kit Mitigation: Update affected Microsoft products with the latest security patches | CVE-2017-0143 Vulnerable Products: Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 Associated Malware: Multiple using the EternalSynergy and EternalBlue Exploit Kit
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.
If the DoublePulsar backdoor does not exist, then the SMB worm attempts to compromise the target using the Eternalblue SMBv1 exploit.
The EternalBlue exploitation tool was leaked by “The Shadow Brokers” group on April 14, 2017, in their fifth leak, “Lost in Translation.”
"...the Shadow Brokers hacked and disclosed a cache of stockpiled NSA cyber capabilities, including the EternalBlue vulnerability, which was later used in the devastating WannaCry and NotPetya ransomware attacks."
"The NSA-developed Windows exploit EternalBlue was stolen and exposed in 2017, eventually enabling destructive operations like North Korea’s WannaCry attack and Russia-linked NotPetya hacks."
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.
Initial Access
1 technique
Initial Access
Execution
2 techniques
Execution
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
Defense Impairment
1 technique
Defense Impairment
Discovery
1 technique
Discovery
Lateral Movement
4 techniques
Lateral Movement
Around January this year, Microsoft was tipped off ... that the NSA's Eternalblue cyber-weapon, which can compromise pre-Windows 10 systems via an SMBv1 networking bug, had been stolen and was about to leak into the public domain.
Our analysis of the artifacts and network traffic at victim networks indicate that modified versions of the EternalBlue and EternalRomance SMB exploits were used, at least in part, to spread laterally.
Command and Control
1 technique
Command and Control
Recent activity
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A leaked NSA-linked Windows exploit set described as enabling system intrusion, lateral movement, and automatic malware propagation. It later underpinned major destructive attacks.
A leaked NSA-linked exploit family targeting Windows that enabled network compromise, lateral spread, and deployment of self-propagating worms.
SMBv1 remote code execution exploit used by WannaCry for initial access and worm-like propagation by triggering a kernel memory corruption condition via crafted SMB packets.
Leaked NSA exploit later abused broadly by criminals, including in ransomware campaigns.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.