Loading story…
Check Point Research detailed how the EternalBlue exploit achieves remote code execution against vulnerable Windows machines by abusing CVE-2017-0144 in Microsoft bulletin MS17-010 over SMBv1. The exploit, leaked by The Shadow Brokers in the "Lost in Translation" dump, targets Windows versions prior to Windows 8 and chains multiple flaws in srv.sys to gain kernel-level code execution.
The research identified three key bugs: a wrong-casting flaw in FEA conversion that causes a non-paged pool overflow, a transaction parsing flaw that creates the size confusion needed to trigger it, and a session setup flaw that enables controlled heap grooming. The paper showed how attackers can shape kernel memory, overwrite srvnet structures and an MDL, redirect writes into the executable HAL heap on older systems, and execute payloads such as DoublePulsar when a crafted srvnet connection closes, with packet-level attack flow illustrated in a successful Windows 7 exploitation trace.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Check Point Research released a technical analysis detailing how EternalBlue achieves remote code execution through three core bugs in SMB processing and kernel heap grooming. The paper also documented packet-level exploitation flow and how the exploit can lead to payload execution such as DoublePulsar on vulnerable Windows systems.
The Shadow Brokers publicly leaked the EternalBlue exploit as part of their 'Lost in Translation' release. The leak exposed offensive tooling that targeted the Windows SMBv1 vulnerability later tracked as CVE-2017-0144.
Microsoft issued security bulletin MS17-010 to fix CVE-2017-0144, the SMBv1 flaw abused by EternalBlue. The vulnerability affected Windows versions prior to Windows 8.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Internet-wide scans found the NSA-linked **DoublePulsar** SMB backdoor on tens of thousands of exposed Windows systems after Shadow Brokers released offensive tooling tied to the implant. Researchers reported infection estimates ranging from roughly 30,000 to more than 120,000 hosts, with infected machines responding to distinctive traffic over port `445`; Microsoft questioned the early counts, but independent investigators said the backdoor had spread rapidly and Countercept later published a method to remotely remove it. Because DoublePulsar operates in memory and leaves no files on disk, it was described as unusually stealthy even as defenders raced to identify and clean compromised systems. Subsequent reporting showed the impact of the leak extended well beyond the initial infections. Symantec said a China-linked group known as **Buckeye/APT3** had used a DoublePulsar variant and related NSA exploit code in real-world attacks as early as March 2016, indicating the capabilities were exposed or replicated long before the public dump. Other leaked SMB exploits, including **EternalChampion**, **EternalRomance**, and **EternalSynergy**, were later ported to work across Windows versions from 2000 through modern releases, while related Shadow Brokers tools such as **EternalBlue** were tied to major outbreaks including **WannaCry** and **NotPetya**, reinforcing the urgency of applying Microsoft’s `MS17-010` patches.
Jun 29, 2026
A critical vulnerability in the Windows SMB client, tracked as CVE-2025-33073, is being actively exploited by threat actors months after Microsoft released a patch. The flaw, which affects Windows 10, Windows 11 (up to version 24H2), and all supported versions of Windows Server, was initially addressed in Microsoft's June 2025 Patch Tuesday update. The vulnerability allows attackers to escalate privileges to SYSTEM level by coercing a victim machine to connect to a malicious SMB server, where the protocol can be compromised. Attackers can exploit this by executing a specially crafted script or convincing users to run such a script, leading to authentication with the attacker's server and subsequent compromise. Security researchers from organizations including CrowdStrike, Synacktiv, GuidePoint Security, BNP Paribas, SySS GmbH, RedTeam Pentesting GmbH, and Google Project Zero contributed to the discovery and public disclosure of the flaw. Some researchers have highlighted that the vulnerability bypasses NTLM reflection mitigations and can be used for authenticated remote command execution, not just privilege escalation as initially described by Microsoft. Technical details and proof-of-concept exploits have been published, increasing the risk of widespread exploitation. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-33073 to its Known Exploited Vulnerabilities (KEV) catalog on October 20, 2025, confirming active exploitation in the wild. CISA has mandated that all US federal civilian agencies apply the patch or remove vulnerable systems from operation by November 10, 2025, under Binding Operational Directive 22-01. While this directive is specific to federal agencies, CISA has strongly urged all organizations to remediate the vulnerability immediately due to the ongoing attacks. The vulnerability was publicly disclosed at the time of patch release, but exploitation was not observed until months later, underscoring the importance of timely patch management. Microsoft has not yet issued a public statement regarding the active exploitation. The flaw's ability to bypass existing mitigations and enable remote command execution makes it particularly dangerous for enterprise environments. Organizations that have not yet applied the June 2025 patch remain at significant risk of compromise. The ongoing exploitation highlights the persistent threat posed by delayed patching and the rapid weaponization of disclosed vulnerabilities. Security teams are advised to prioritize remediation and monitor for signs of exploitation related to CVE-2025-33073.
Jun 29, 2026
Microsoft disclosed and patched several Windows elevation-of-privilege vulnerabilities affecting networking-related components, including **Windows Remote Access Connection Manager**, **Windows SMB Server**, and **Network Connection Status Indicator (NCSI)**. The issues tracked as `CVE-2025-62474`, `CVE-2025-62472`, `CVE-2025-47955`, `CVE-2025-59201`, and `CVE-2025-58726` could allow attackers with limited access to gain higher privileges on targeted systems, extending a pattern of privilege-escalation risk previously seen in the same Remote Access Connection Manager component with `CVE-2022-21914`. Among the disclosed flaws, Microsoft provided additional detail for **`CVE-2025-58726`**, describing an **Important** improper access control issue in **Windows SMB Server** that can let an authorized low-privilege attacker elevate to **SYSTEM** over the network by coercing a victim machine to authenticate to an attacker-controlled SMB server using a specially crafted script. Microsoft assigned the bug **CWE-284** and a **CVSS v3.1 score of 7.5**, said exploitation required specific conditions involving an unused or nonexistent Service Principal Name on the target, and stated that the vulnerability was neither publicly disclosed nor exploited in the wild at publication and that a security fix was available.
Jun 29, 2026