Loading story…
Internet-wide scans found the NSA-linked DoublePulsar SMB backdoor on tens of thousands of exposed Windows systems after Shadow Brokers released offensive tooling tied to the implant. Researchers reported infection estimates ranging from roughly 30,000 to more than 120,000 hosts, with infected machines responding to distinctive traffic over port 445; Microsoft questioned the early counts, but independent investigators said the backdoor had spread rapidly and Countercept later published a method to remotely remove it. Because DoublePulsar operates in memory and leaves no files on disk, it was described as unusually stealthy even as defenders raced to identify and clean compromised systems.
Subsequent reporting showed the impact of the leak extended well beyond the initial infections. Symantec said a China-linked group known as Buckeye/APT3 had used a DoublePulsar variant and related NSA exploit code in real-world attacks as early as March 2016, indicating the capabilities were exposed or replicated long before the public dump. Other leaked SMB exploits, including EternalChampion, EternalRomance, and EternalSynergy, were later ported to work across Windows versions from 2000 through modern releases, while related Shadow Brokers tools such as EternalBlue were tied to major outbreaks including WannaCry and NotPetya, reinforcing the urgency of applying Microsoft’s MS17-010 patches.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
In May 2019, Symantec disclosed that Buckeye had used a DoublePulsar variant and related exploit beginning in March 2016, suggesting NSA cyber capabilities had been exposed, copied, or stolen far earlier than previously understood.
By November 2018, reporting highlighted that about 45,000 systems remained vulnerable or exposed to older NSA-linked Windows exploitation techniques, underscoring persistent patching failures long after the original leaks.
In March 2018, reporting on leaked NSA files showed that the agency had developed Territorial Dispute scripts that, by 2013, were being used to identify other nation-state and advanced threat actors on compromised machines using a compact set of signatures.
RiskSense researcher Sean Dillon adapted EternalChampion, EternalRomance, and EternalSynergy to work across a broad range of Windows versions from Windows 2000 through modern Windows 10 and Server 2016 builds, and the code was merged into Metasploit. Patched systems protected by MS17-010 were not affected.
In May 2017, following the global WannaCry outbreak tied to leaked NSA SMB tooling, the Shadow Brokers publicly threatened to release more hacking tools and exploits.
By late April 2017, independent scans were estimating roughly 30,000 to more than 120,000 infected systems, and Countercept published an updated detection script capable of remotely uninstalling DoublePulsar from affected hosts.
Soon after the leak, security researchers reported active exploitation of exposed Windows hosts and identified tens of thousands of systems that appeared to be infected with the DoublePulsar backdoor over SMB port 445. Microsoft said it doubted the reported totals and was investigating.
In April 2017, the Shadow Brokers publicly released NSA offensive tools including SMB exploits and the DoublePulsar implant, making the capabilities broadly available to attackers and defenders.
Symantec later reported that the Buckeye/APT3 group used a variant of the NSA-developed DoublePulsar backdoor and a related Windows exploit against multiple targets beginning in March 2016, indicating the capability was in use well before the public Shadow Brokers leak.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcetheintercept.com
Open sourcebleepingcomputer.com
Open sourcetheguardian.com
Open sourcearstechnica.com
Open sourcearstechnica.com
Open sourcearstechnica.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research detailed how the **EternalBlue** exploit achieves remote code execution against vulnerable Windows machines by abusing `CVE-2017-0144` in Microsoft bulletin `MS17-010` over `SMBv1`. The exploit, leaked by **The Shadow Brokers** in the "Lost in Translation" dump, targets Windows versions prior to Windows 8 and chains multiple flaws in `srv.sys` to gain kernel-level code execution. The research identified three key bugs: a wrong-casting flaw in FEA conversion that causes a non-paged pool overflow, a transaction parsing flaw that creates the size confusion needed to trigger it, and a session setup flaw that enables controlled heap grooming. The paper showed how attackers can shape kernel memory, overwrite `srvnet` structures and an `MDL`, redirect writes into the executable HAL heap on older systems, and execute payloads such as **DoublePulsar** when a crafted `srvnet` connection closes, with packet-level attack flow illustrated in a successful Windows 7 exploitation trace.
Jun 29, 2026
WannaCry encrypted files across organizations worldwide after a worm component exploited the Windows SMBv1 flaw patched in **MS17-010**, driving rapid propagation beyond initial phishing-based infections. Reported victims included the UK's **NHS**, **Telefónica**, **Iberdrola**, Russia's Interior Ministry, **FedEx**, and **Deutsche Bahn**, while hotspots were reported in Ukraine, Taiwan, and later China. Infected systems typically displayed ransom demands of **$300** or **$600** in Bitcoin, and Microsoft issued emergency patches even for unsupported platforms such as **Windows XP** as governments and incident responders urged organizations to report infections and patch exposed systems. Technical analysis found the malware checked a kill-switch domain, scanned local and random external IP ranges, looked for the **DoublePulsar** backdoor, and used **EternalBlue** when DoublePulsar was absent to deliver the ransomware payload. WannaCry used **RSA-2048** and **AES-128** for encryption, deleted shadow copies and recovery artifacts, terminated database and Exchange-related processes, and communicated with Tor hidden services over an encrypted protocol. Later reporting indicated **Windows 7** and **Windows Server 2008** accounted for most infections, while many **XP** systems crashed instead of reliably propagating the worm; researchers also noted the kill-switch likely prevented far more infections and that shared Bitcoin wallets reduced confidence that paying victims would be consistently decrypted.
Jun 29, 2026
A critical vulnerability in the Windows SMB client, tracked as CVE-2025-33073, is being actively exploited by threat actors months after Microsoft released a patch. The flaw, which affects Windows 10, Windows 11 (up to version 24H2), and all supported versions of Windows Server, was initially addressed in Microsoft's June 2025 Patch Tuesday update. The vulnerability allows attackers to escalate privileges to SYSTEM level by coercing a victim machine to connect to a malicious SMB server, where the protocol can be compromised. Attackers can exploit this by executing a specially crafted script or convincing users to run such a script, leading to authentication with the attacker's server and subsequent compromise. Security researchers from organizations including CrowdStrike, Synacktiv, GuidePoint Security, BNP Paribas, SySS GmbH, RedTeam Pentesting GmbH, and Google Project Zero contributed to the discovery and public disclosure of the flaw. Some researchers have highlighted that the vulnerability bypasses NTLM reflection mitigations and can be used for authenticated remote command execution, not just privilege escalation as initially described by Microsoft. Technical details and proof-of-concept exploits have been published, increasing the risk of widespread exploitation. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-33073 to its Known Exploited Vulnerabilities (KEV) catalog on October 20, 2025, confirming active exploitation in the wild. CISA has mandated that all US federal civilian agencies apply the patch or remove vulnerable systems from operation by November 10, 2025, under Binding Operational Directive 22-01. While this directive is specific to federal agencies, CISA has strongly urged all organizations to remediate the vulnerability immediately due to the ongoing attacks. The vulnerability was publicly disclosed at the time of patch release, but exploitation was not observed until months later, underscoring the importance of timely patch management. Microsoft has not yet issued a public statement regarding the active exploitation. The flaw's ability to bypass existing mitigations and enable remote command execution makes it particularly dangerous for enterprise environments. Organizations that have not yet applied the June 2025 patch remain at significant risk of compromise. The ongoing exploitation highlights the persistent threat posed by delayed patching and the rapid weaponization of disclosed vulnerabilities. Security teams are advised to prioritize remediation and monitor for signs of exploitation related to CVE-2025-33073.
Jun 29, 2026