Loading malware…
EternalBlue is a remote code execution exploit targeting the SMBv1 implementation in Microsoft Windows, principally associated with CVE-2017-0144. It is an exploitation tool rather than a standalone malware family. Originally developed by the U.S. National Security Agency and included in the Fuzzbunch toolkit, it was publicly released by the Shadow Brokers on April 14, 2017. Microsoft had addressed the vulnerability in the MS17-010 security update released on March 14, 2017.
The exploit sends specially crafted SMB requests that trigger memory corruption in the Windows kernel, enabling execution of attacker-controlled code on vulnerable systems without user interaction. It can compromise exposed SMB services or support lateral movement within internal networks. EternalBlue has frequently been paired with DoublePulsar to install a kernel backdoor and execute subsequent payloads; those backdoor functions belong to DoublePulsar, not EternalBlue itself. Exploitation can also crash targeted systems.
EternalBlue enabled propagation in the WannaCry ransomware and NotPetya destructive-malware outbreaks and has been incorporated into EternalRocks and cryptocurrency-mining attack chains. BackdoorDiplomacy has also used it operationally. Its targets are unpatched Windows workstations and servers across industries, rather than a particular sector.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
EternalBlue is an exploit designed to attack SMB (Server Message Block) file and print sharing services on the affected windows versions.
EternalBlue is an exploit designed to attack SMB (Server Message Block) file and print sharing services on the affected windows versions.
The ransomware perpetrators incorporated publicly-available exploit code for the patched SMB EternalBlue vulnerability, CVE-2017-0145, which can be triggered by sending a specially crafted packet to a targeted SMB server.
EternalBlue exploits (MS17-010) CVE-2017-0144
EternalBlue is an exploit designed to attack SMB (Server Message Block) file and print sharing services on the affected windows versions.
EternalBlue is an exploit designed to attack SMB (Server Message Block) file and print sharing services on the affected windows versions.
9 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.
The leak included EternalBlue, an exploit for the SMB protocol in Windows that the NSA had likely held for years.
The leak included EternalBlue, an exploit for the SMB protocol in Windows that the NSA had likely held for years.
The leak included EternalBlue, an exploit for the SMB protocol in Windows that the NSA had likely held for years.
Windows executable versions of publically available EternalBlue/EternalRomance exploit scripts.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
During our analysis, we also discovered that Amadey was actively pushing the Remcos RAT via its control panel... We have also seen instances of Amaday C&C servers recently that are actively pushing DoublePulsar backdoor and EternalBlue exploit payloads on the victim machine.
EternalBlue required zero user interaction and zero authentication, allowing it to spread laterally across networks at machine speed. The article also recommends restricting internal SMB traffic to limit the blast radius of lateral movement.
41 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A leaked NSA-linked Windows exploit set described as enabling system intrusion, lateral movement, and automatic malware propagation. It later underpinned major destructive attacks.
A leaked NSA-linked exploit family targeting Windows that enabled network compromise, lateral spread, and deployment of self-propagating worms.
SMBv1 remote code execution exploit used by WannaCry for initial access and worm-like propagation by triggering a kernel memory corruption condition via crafted SMB packets.
Leaked NSA exploit later abused broadly by criminals, including in ransomware campaigns.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.