The leak

On 13 August 2016 an entity calling itself announced it had stolen the tools of the Equation Group - the offensive unit inside the United States National Security Agency (NSA) - and would auction them. Nobody bid seriously. Over the following months the group published in instalments, taunting in broken English, and on 14 April 2017 released the file that mattered, under the title "Lost in Translation". It contained a working exploit, codenamed , for a flaw in Server Message Block version 1 (SMBv1), the file-sharing protocol that has been enabled by default on Windows since the 1990s.

Who they were has never been established. What matters for the record is the timing. Microsoft had issued the patch, MS17-010, on 14 March 2017 - a month before the exploit was public - and had done so, in its own words, after information was received from a third party. The most credible public reading is that the NSA, knowing its tools were gone, told the . That is the whole shape of the vulnerabilities-equities debate in a single sequence: an agency found a flaw in a protocol running on every Windows machine on earth, kept it for years to use it, and disclosed it only when it had been robbed. The patch existed for fifty-nine days before it mattered. Millions of machines did not have it.

WannaCry, 12 May 2017

The first thing to use EternalBlue at scale was with a worm attached. It encrypted files, demanded 300 dollars in Bitcoin, and - unlike ordinary ransomware, which arrives by email and stays where it lands - scanned for other machines with port 445 open and infected them without anyone clicking anything. It reached an estimated 200,000 to 300,000 computers in more than 150 countries in a day. In England, 80 of 236 National Health Service trusts and nearly 600 general practices were disrupted; roughly 19,000 appointments and operations were cancelled; ambulances were diverted. Renault, Nissan, Telefónica, Deutsche Bahn and FedEx were hit.

It stopped for an unusual reason. Marcus Hutchins, a 22-year-old British researcher, reverse-engineered the sample, noticed it queried a long unregistered domain before doing anything, and registered it for about ten dollars, expecting only to sink the traffic for analysis. The lookup was a kill switch: if the domain resolved, the malware exited. He had disabled the campaign by accident, in the sense that he had not known that was what he was doing, and by expertise, in the sense that nobody else had looked. His own reaction, published the next day, was titled "How to Accidentally Stop a Global Cyber Attack."

Two things follow, and they belong together. The United States and the United Kingdom formally attributed to North Korea in December 2017. And in August of the same year Hutchins was arrested in Las Vegas over malware he had written years earlier as a teenager; he pleaded guilty in 2019 and was sentenced to time served. The person who stopped the worst worm of the decade and the person prosecuted for writing banking malware were the same person, and both facts are true.

NotPetya, 27 June 2017

Six weeks later something used EternalBlue again, and this one was not ransomware.

It entered through the update mechanism of M.E.Doc, the accounting software that almost every company filing taxes in Ukraine is required to use, made by a small family firm called Linkos Group. Attackers had been inside that firm's servers for months. When the poisoned update went out, it landed simultaneously inside banks, ministries, the power grid, the airport, the metro, and the radiation monitors at Chernobyl - and inside every multinational with a Ukrainian office. This is route one of the supply chain taxonomy - own the supplier - executed against a country.

Once inside a network it did not need EternalBlue to keep moving. It also used EternalRomance, and, more effectively, Mimikatz-style credential theft with the ordinary Windows administration tools PsExec and WMIC, which meant that a fully patched machine could be taken by an administrator's stolen credentials. Then it overwrote the master boot record. It displayed a ransom note, but the "installation key" was random data: there was no key, no decryption, and no way to pay for one. It was destruction dressed as extortion.

The costs are what make it the entry it is. Maersk, which moves about a fifth of the world's shipping containers, lost 4,000 servers, 45,000 PCs and 2,500 applications, and rebuilt in ten days only because a power cut in Ghana had left one domain controller offline with the last surviving copy of its ; the loss was 250 to 300 million dollars. Merck's was about 870 million. FedEx's TNT unit, 400 million. Mondelez, Reckitt Benckiser, Saint-Gobain and Ukraine's own economy took the rest. In February 2018 the White House called it the most destructive and costly cyberattack in history, put the total near 10 billion dollars, and attributed it to the Russian military; the United Kingdom's National Cyber Security Centre said the same, naming the GRU.

Then the insurers refused to pay. Mondelez's and Merck's policies excluded "hostile or warlike action by a government or sovereign power", and the insurers argued that a state-attributed attack was exactly that. Merck won at trial and on appeal in New Jersey in 2023, the court holding that the exclusion had always meant armed conflict and had never been rewritten for cyber operations; Mondelez settled. The war exclusion has since been rewritten across the market, and every cyber-insurance policy sold today is worded the way it is because of one Ukrainian tax program.

What a practitioner should take from it

SMBv1 was thirty years old and enabled by default. Microsoft began disabling it in Windows 10 in 2017 and it is now off by default everywhere, but the reason it survived so long is the reason old things always survive: something, somewhere, still used it. The audit question is not whether SMBv1 is needed; it is which machine still speaks it, and the same question applies to every protocol left enabled for compatibility - which is the argument the named TLS attacks make about export ciphers and SSL 2.0.

Patching is not the same as being patched. MS17-010 was available for two months before WannaCry and three before . The organisations that fell were not unaware; they were unable - because of a change window, an unsupported dependency, an nobody owned. The NHS was running Windows XP on medical equipment whose manufacturers had not certified anything newer.

A patched machine can still fall. NotPetya's most effective propagation was credential theft plus legitimate administration tools. Flat networks and reused local administrator passwords turned one compromised host into a whole estate. Segmentation and unique local credentials would have limited it where patching could not.

The blast radius of an update channel is the whole customer base. M.E.Doc is the same shape as the 3CX compromise, the Trend Micro pattern file and the XZ backdoor: the mechanism that keeps software current is the mechanism that can distribute anything, instantly, to everyone who trusts it.

And an exploit does not stay where it was made. The NSA held EternalBlue for years on the judgement that its offensive value exceeded the risk of the flaw being found by someone else. The flaw was not found by someone else. The exploit was stolen, published, and used within eight weeks against hospitals, ports and power grids - by two different states, for two different purposes, neither of them the one it was written for.

Sources