Pre-2017: NSA Tailored Access Operations (TAO), operating as the Equation Group, develops EternalBlue as an offensive exploit targeting SMBv1 on Windows systems. Used in classified operations for years before disclosure.

March 14, 2017: Microsoft releases MS17-010 security bulletin patching six SMBv1 vulnerabilities (CVE-2017-0143 through CVE-2017-0148). The patch appears to have been driven by advance notification that the exploit would be leaked.

April 14, 2017: Shadow Brokers publish a trove of NSA hacking tools including EternalBlue, EternalRomance, EternalChampion, and EternalSynergy. The exploit is now public. Metasploit integration follows within days.

May 12, 2017: WannaCry ransomware begins spreading globally using EternalBlue as its propagation mechanism. 200,000+ systems across 150+ countries infected within days. UK National Health Service crippled. Attributed to Lazarus Group / DPRK.

June 27, 2017: NotPetya launches via compromised M.E.Doc software update in Ukraine, using EternalBlue + EternalRomance for lateral movement. Spreads globally. $10B+ in damages. Maersk loses 49,000 endpoints. Merck, FedEx, Rosneft, multiple hospitals hit. Attributed to Sandworm / GRU Unit 74455. The most expensive cyberattack in history.

2018-present: EternalBlue is incorporated into commodity malware, cryptominers (WannaMine), banking trojans (TrickBot, Emotet), and continues to be used by nation-state actors and ransomware affiliates against unpatched systems. Years after the patch, hundreds of thousands of internet-facing systems remain vulnerable.

Healthcare. WannaCry's defining victim. 80+ UK NHS hospital trusts disrupted, 19,000 appointments cancelled, ambulances diverted, MRI and diagnostic equipment shut down. Healthcare runs legacy Windows on medical devices, imaging workstations, patient records systems, and lab equipment that vendors won't certify patches for. Device manufacturers lock firmware configurations, voiding warranties if hospitals apply OS patches. Still the sector most likely to have vulnerable systems in 2026. If you're in healthcare, assume EternalBlue-vulnerable devices exist on your network until you prove otherwise.

Shipping and logistics. NotPetya destroyed Maersk's entire IT infrastructure: 49,000 endpoints, 4,000 servers, 45,000 PCs. The world's largest container shipping company operated on paper and WhatsApp for two weeks while rebuilding from scratch. Their only surviving domain controller was in a Ghana office where a power outage had kept it offline during the attack. $300M in direct losses. FedEx/TNT Express lost $400M. If your organization moves physical goods, your logistics systems (warehouse management, shipping terminals, fleet management) likely run on the same legacy Windows stack that Maersk did.

Pharmaceutical and manufacturing. Merck took $870M+ in NotPetya damages. Manufacturing lines shut down. Vaccine production disrupted for months. Mondelez (Cadbury parent) lost $188M. Reckitt Benckiser lost $129M. Manufacturing floor systems run Windows Embedded on HMIs, historians, and MES platforms with the same frozen-config problem as healthcare. Pharmaceutical manufacturing has the additional consequence that a cyber incident can invalidate GMP batch records and trigger FDA re-validation, turning a week of downtime into months of regulatory recovery.

Energy and utilities. Ukrainian energy companies were NotPetya's primary targets. Rosneft, Russia's own largest oil company, was hit by its own government's weapon. Energy sector OT runs Windows on engineering workstations, historian servers, and HMI platforms at Purdue Levels 2-3 where EternalBlue-vulnerable systems persist behind "isolated" segments that have jump hosts. The wormable nature of EternalBlue means it crosses the jump host without anyone clicking anything.

Telecommunications. Telefonica (Spain) was one of the earliest confirmed WannaCry victims. Telecom infrastructure runs legacy Windows in OSS/BSS (Operations and Business Support Systems) platforms that manage provisioning, billing, and network management. These systems are often vendor-maintained with restricted patch schedules.

Government and defense. Multiple agencies globally were affected by both WannaCry and NotPetya. The ultimate irony: a US government exploit, developed by the NSA, leaked by Shadow Brokers, was used against US government systems, allied government systems, and the global economy. Government networks run legacy Windows on classified and unclassified systems with long certification cycles that delay patching.

MS17-010 is not a single CVE. It's a family. Scanning for only CVE-2017-0144 misses the rest.

• CVE-2017-0143 SMBv1 RCE. Type confusion vulnerability.
• CVE-2017-0144 SMBv1 RCE. The "EternalBlue" exploit itself. Buffer overflow in SrvOs2FeaToNt via DWORD-to-WORD truncation in SrvOs2FeaListSizeToNt. Unauthenticated, wormable, SYSTEM-level code execution.
• CVE-2017-0145 SMBv1 RCE. Exploited by "EternalRomance."
• CVE-2017-0146 SMBv1 RCE. Exploited by "EternalChampion" and "EternalSynergy."
• CVE-2017-0147 SMBv1 Information Disclosure. Often used as a precursor to the RCE exploits for memory layout reconnaissance.
• CVE-2017-0148 SMBv1 RCE. Additional SMBv1 transaction handling flaw.

Affected systems: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 10 (early builds), Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2. Anything running SMBv1 on TCP 445 without the MS17-010 patch. Including Siemens ultrasound equipment, industrial control systems running embedded Windows, and any device that implements the SMBv1 protocol.

EternalBlue is one of the most network-detectable exploits in existence. The exploitation sequence has distinctive signatures that Suricata, Zeek, and Arkime can all see.

1. 1. Scan for vulnerable systems Run an MS17-010 vulnerability scan across the entire network. Nmap: nmap -p 445 --script smb-vuln-ms17-010 [target]. Metasploit: auxiliary/scanner/smb/smb_ms17_010. Your vulnerability scanner (Nessus, Qualys, Rapid7) has dedicated MS17-010 checks. The scan should cover every subnet including OT segments, management VLANs, and DMZs. Do not assume segments are clean because they're "patched." Verify. NET: TCP 445 scan · Nmap smb-vuln-ms17-010 · Vulnerability scanner MS17-010 plugin
2. 2. Check whether SMBv1 is disabled (not just patched) Patching closes the specific vulnerability. Disabling SMBv1 removes the entire attack surface. Both should be done. On Windows: Get-SmbServerConfiguration | Select EnableSMB1Protocol. On the wire: check whether any host responds to SMBv1 dialect negotiation. Microsoft has recommended disabling SMBv1 since 2016. If it's still enabled, there's usually a legacy application dependency that needs to be identified and addressed. PowerShell: Get-SmbServerConfiguration · GPO: MS network server: Digitally sign communications
3. 3. Block TCP 445 at every boundary SMB should never cross a network perimeter. Block TCP 445 (and TCP 139, UDP 137-138) at the internet-facing firewall, between security zones, and between workstation subnets. Internal workstation-to-workstation SMB is almost never necessary and is the primary lateral movement path for wormable exploits. Servers that need SMB access should be explicitly allowlisted. Firewall rules · NET: Zeek conn.log for TCP 445 flows between unexpected pairs
4. 4. Hunt for exploitation attempts in network telemetry Search Suricata alerts for ET EXPLOIT ETERNALBLUE signatures. In Arkime, search for SMB sessions with anomalous transaction sizes on TCP 445. In Zeek, look for SMB connections between hosts that don't have a file-sharing relationship. An exploitation attempt (even a failed one) means something on your network is scanning for vulnerable SMB hosts. NET: Lateral Movement · Suricata ET EXPLOIT · Arkime sessions · Zeek smb_mapping.log
5. 5. Check for post-exploitation lateral movement EternalBlue gives SYSTEM-level access. What happens next: credential dumping (LSASS, SAM), PsExec or WMI lateral movement to additional hosts, ransomware deployment, or cryptominer installation. If you find a successful EternalBlue exploitation, scope laterally immediately. The compromised host has SYSTEM and every credential cached on it is burned. HOST: T1003.001 LSASS · HOST: Lateral Movement
6. 6. Check OT and legacy systems specifically The systems most likely to be vulnerable in 2026 are: OT engineering workstations running Windows 7 or Server 2008 with frozen patch levels, medical devices running embedded Windows, kiosk systems, legacy application servers that "can't be updated," and backup/recovery images from pre-patch dates. These systems are often on isolated segments, but "isolated" frequently means "has a jump host" not "has no network path." Air-Gapped OT playbook · Asset inventory cross-reference
7. 7. Monitor for backup restoration regression A patched system can become vulnerable again if a backup from before March 2017 is restored. Bare-metal recovery, VM snapshot rollback, and disaster recovery tests can silently reintroduce the vulnerability. Continuous validation (daily automated checks of SMBv1 status and patch level) catches regression that quarterly scans miss. Backup/recovery audit · VM snapshot date validation · Continuous vulnerability scanning
8. 8. If exploitation is confirmed: treat it as a full compromise EternalBlue delivers SYSTEM-level access without authentication. If a host was exploited: assume every credential on that host is compromised, check for lateral movement to other hosts (via the same exploit or via stolen credentials), check for persistence mechanisms planted by the attacker, and rebuild the host from known-good media after investigation. C2 Beacon playbook · Ransomware playbook

Legacy OS in OT. Windows 7 and Server 2008 R2 are end-of-life but remain in production across manufacturing, energy, healthcare, and transportation because the applications running on them can't be migrated. These systems can't be patched without breaking the application, and they're often connected to networks that other vulnerable systems can reach.

Frozen configurations. Industrial control systems and medical devices often run on Windows Embedded with vendor-locked configurations. The vendor hasn't certified the MS17-010 patch. The device owner can't apply it without voiding the warranty or losing support. The vulnerability persists by contractual obligation.

Backup drift. A system patched in 2017 gets restored from a 2016 backup during a disaster recovery exercise. It's now vulnerable again. Nobody notices because the vulnerability scanner runs monthly, the DR test happened on the wrong week, and the system looks "normal."

Network segmentation gaps. "It's on an isolated VLAN" usually means "there's a jump host." The jump host has SMB access to both the isolated segment and the corporate network. EternalBlue crosses the jump host. The segmentation was never tested against a wormable exploit.

Lazarus Group - WannaCry (May 2017). First mass weaponization. 200,000+ systems, 150+ countries, NHS disrupted.
Sandworm - NotPetya (June 2017). EternalBlue + EternalRomance for lateral movement. $10B+ damages. Most expensive cyberattack in history.
TrickBot / Emotet - Banking trojan ecosystem incorporated EternalBlue for lateral spread across enterprise networks. Fed the ransomware pipeline for years.
WannaMine - Cryptominer using EternalBlue for propagation. Fileless variant runs entirely in memory. Still active.
Ransomware affiliates - Multiple RaaS affiliates continue to use EternalBlue as a lateral movement technique against unpatched internal systems after initial access via other vectors.

Ransomware Detected (WannaCry is the defining ransomware event, NotPetya was disguised as one)
Air-Gapped OT / ICS (legacy Windows systems most likely to remain vulnerable)
C2 Beacon Found (post-EternalBlue exploitation typically establishes C2)
Sandworm (NotPetya) · Lazarus (WannaCry)