E is for EternalBlue — The Day the Weapons Escaped

TI-2026-071E · Series: 🕰️ The Alphabet of Harm · Letter E · TLP:WHITE · 2026-07-09

Letter A warned that the apex predator's tools diffused downward until they were ambient. E is the day that diffusion happened all at once, with a date and a body count. This is the letter about the moment two states lost their most guarded weapons, watched a leak they had been warned about detonate on hospitals within weeks, and discovered that a cyber-weapon, once escaped, can never be recalled — because it was never a thing you could spend. It was only ever a copy.

📋 The Short Version

In 2017 the classified cyber-weapon stockpiles of two agencies fell out of the safe. In March, WikiLeaks published Vault 7 — 8,761 documents of the CIA's hacking tools. In April, a group calling itself the Shadow Brokers dumped the NSA's Equation Group exploits, including EternalBlue (MS17-010): an unauthenticated remote-code-execution flaw in a network protocol running on millions of Windows machines.

WikiLeaks did not merely leak the CIA's tools. It named the danger, precisely, in its own release: "Comparisons can be drawn between the uncontrolled proliferation of such 'weapons'… and the global arms trade." And: "if the CIA can hack these phones then so can everyone else who has obtained or discovered the vulnerability… a serious proliferation risk."

The prophecy came true in weeks. In May, EternalBlue powered WannaCry, which froze hospitals across the UK's NHS. In June, it powered NotPetya, which the US Department of Justice documents crippling American hospitals — "two hospitals, 60 physician offices, and 18 community satellite facilities" — with total damage estimated near $10 billion.

And then the weapon did the thing that makes it letter E. It did not get spent, or recovered, or contained. It became a free download. Open our OSINT library today and EternalBlue is a standard Metasploit module, its author field crediting "Shadow Brokers" and "Equation Group" — the leakers and the spy agency, listed as co-authors of a public tool anyone can run.

Verdict: MUTATED — by proliferation. EternalBlue did not end and was never recalled. It escaped and multiplied: from a classified state zero-day, to a global weapon in criminal and rival-state hands, to a permanent line in the commodity arsenal. Proliferation is mutation's most irreversible form. Confidence: HIGH on the leak, the weaponization, and the weapon's persistence as public tooling — all documented, some in our own library. MEDIUM on precise damage figures and on attributing the entire modern public-arsenal economy causally to these specific leaks (§8). Scope note: EternalBlue targets SMB (port 445); our SSH/HTTP sensors do not observe it directly. The present-day evidence here is the Metasploit-module fact and the never-retires exploit pattern EternalBlue founded — not a direct capture.

1. What a Cyber-Weapon Actually Is

To understand why this letter's verdict can never be ENDED, you have to understand what kind of object EternalBlue is — because it is not like the weapons the arms-trade metaphor evokes.

A physical weapon is rivalrous. A missile, once fired, is gone. A rifle in your hands is not in mine. This is the entire basis of arms control: weapons are countable, spendable, seizable. You can inventory a stockpile, and you can reduce it.

A cyber-weapon is the opposite. EternalBlue is information — a specific sequence of bytes that triggers a specific flaw. It can be copied infinitely at zero cost, and a copy is not a degraded version; it is the identical weapon. When the Shadow Brokers leaked it, the NSA did not lose EternalBlue the way an armory loses a rifle. The NSA still had it. Everyone else also now had it, in full, forever. There is no "recovering" a leaked exploit, because there was never a scarce physical object to recover. There was only a fact — SMBv1 mishandles this packet — and once a fact is public, it is public for the life of the vulnerable protocol.

This is why WikiLeaks reached for the arms-trade comparison and then, in the same breath, exceeded it. The proliferation of a cyber-weapon is worse than the arms trade, because in the arms trade the seller at least gives up the gun. Here, the seller keeps the gun, the buyer gets the gun, and so does everyone downstream of the buyer, and the gun never runs out of bullets. That property — infinite, lossless, permanent copyability — is the mechanism behind every word of this letter.

2. The Armory Door Opens

The archive holds the moment the door opened, and it holds it as the leak's own warning.

Vault 7's "Year Zero" release, March 2017, was 8,761 documents describing the CIA's Center for Cyber Intelligence and its arsenal — malware, remote-control systems, and "zero day" exploits against Android, iOS, Windows, routers, even smart TVs. WikiLeaks' framing is the intellectual core of this entire letter, and it deserves to be read in full:

"Comparisons can be drawn between the uncontrolled proliferation of such 'weapons', which results from the inability to contain them combined with their high market value, and the global arms trade."

And, on the specific mechanism of the danger:

"if the CIA can hack these phones then so can everyone else who has obtained or discovered the vulnerability. As long as the CIA keeps these vulnerabilities concealed… they [pose] a serious proliferation risk."

Sit with what that argues. The leak's own authors identified the root harm not as the CIA has hacking tools — a state having cyber-capability is unremarkable — but as the decision to hoard undisclosed vulnerabilities instead of reporting them for patching. A stockpiled zero-day is a bet: a bet that the stockpile will never leak. Vault 7, and a month later the Shadow Brokers, were that bet being called on two agencies simultaneously. The vulnerabilities the state kept secret so it could use them were the exact vulnerabilities that, upon leaking, everyone else could use too — because a concealed flaw protects no one, least of all the millions of machines running the unpatched protocol.

The NSA's leak was the sharper of the two, because it came with working weapons attached. Vault 7 was largely documentation; the Shadow Brokers dump was the exploits themselves, ready to fire: EternalBlue, EternalRomance, EternalSynergy, EternalChampion, and the DoublePulsar kernel implant. The archive holds their technical shape — EternalBlue triggers an SMBv1 buffer overflow through a mathematical error in an OS/2 FEA-list size conversion, achieving remote code execution with no valid credentials required. An unauthenticated RCE against a protocol running on millions of machines, built by a state, now in the hands of anyone who downloaded a torrent.

3. The Detonation

The gap between "weapon leaks" and "weapon detonates on hospitals" was, in the historical record, about eight weeks.

WannaCry — May 2017. Ransomware operators bolted EternalBlue onto a self-spreading worm. It tore through unpatched Windows machines worldwide, and its most infamous victims were hospitals: the UK's National Health Service saw operations cancelled and ambulances diverted as machines locked. A stolen NSA exploit, four weeks out of the safe, was interrupting cancer treatment.

NotPetya — June 2017. A month after WannaCry, the destruction escalated. The DOJ's indictment of Russia's GRU Unit 74455 (Sandworm) — the same actor named in letter A's pantheon — documents NotPetya as malware "designed to spread to connected networks belonging to other victims." It was aimed at Ukraine but engineered to leap borders, and it did: the indictment records it compromising "two hospitals, 60 physician offices, and 18 community satellite facilities" of the Heritage Valley Health System in Pennsylvania, rendering computer systems inoperable. Estimates of total NotPetya damage run near $10 billion, making it one of the most costly cyberattacks in history.

Read the chain of custody: a vulnerability the NSA discovered and hoarded, leaked by the Shadow Brokers, weaponized by the Russian military, detonating on American hospitals. Every arrow in that sentence is a documented handoff, and the whole path took two months. This is what "a serious proliferation risk" means when the abstraction is cashed out. It means a weapon your own government built comes back around the world and freezes the computer in your local emergency room.

4. The Permanent Form

WannaCry and NotPetya were the explosions. They were also, in a sense, the transient part of the story — episodes, dated, eventually patched-around. The permanent part is quieter and, for this alphabet, more important.

EternalBlue did not go away when WannaCry was contained. It settled into the commons. Open our OSINT library and it is a standard Metasploit module — ms17_010_eternalblue.rb — sitting in the default arsenal of the world's most widely-used exploitation framework, one command away from anyone who installs it. The companion suite is all there too: smb_doublepulsar_rce.rb, the ms17_010 command-execution module for EternalRomance/Synergy/Champion, the MS17-010 scanner keyed to CVE-2017-0143 through CVE-2017-0148.

And the detail that says everything: the author field. These modules credit, alongside the community researchers who packaged them, "Shadow Brokers" and "Equation Group." The leakers and the spy agency are listed as co-authors of a free public tool. There is no more literal illustration of proliferation than a nation-state's most secret weapon appearing in an open-source repository with the leak crew in the byline.

This is the concrete form of the claim letter A made in the abstract. A said the "advanced" of Advanced Persistent Threat had been hollowed out into a public download. E is that sentence made verifiable: the most advanced thing on earth in early 2017 — an NSA zero-day worth a fortune, guarded as a national-security asset — is, in 2026, a module. Not a metaphor for a module. A module, in our library, that you can read the source of right now.

4b. The Patch That Was Already There

There is a detail in the timeline that complicates the horror and deepens it at once. Microsoft patched the EternalBlue vulnerability in March 2017 \u2014 MS17-010 \u2014 before the Shadow Brokers publicly dumped the exploit in April, reportedly tipped off that the leak was coming. So when WannaCry tore through the world in May, it did not exploit an unknown flaw. It exploited an unapplied one. Every machine WannaCry locked, every NHS ward it froze, every hospital NotPetya crippled through this vector, was a machine that could have been patched, for free, weeks earlier, and was not.

That reframes the harm without excusing the leak. The proliferation was catastrophic and the damage was, in a strict technical sense, preventable at zero cost by anyone who applied a routine update. Both are true, and the gap between them is the entire tragedy of patch management: a fix existed, was published, was free \u2014 and the vast, under-maintained floor of the internet did not apply it in time, because that floor runs the way letter D described, with no one watching and no pressure to act. EternalBlue is thus two harms stacked: a state that hoarded and lost a weapon, and a world that could not be bothered to close the door the vendor had already built for it. The exploit was eternal not only because a copied fact never expires, but because the neglect it preys on never does either. Somewhere, right now, an unpatched SMBv1 machine is still being scanned for MS17-010, nine years after the fix shipped \u2014 which is the same sentence, in a different protocol, as the 2018 miner still brute-forcing root in letter D.

5. What We Actually Catch — the Founding Event

Here the honest bridge to our own systems must be stated carefully, because EternalBlue is an SMB (port 445) weapon and our sensors watch SSH and HTTP. We do not catch EternalBlue on the wire. What we catch is the world it created.

EternalBlue is the founding event of The Open Armory — the thesis of series 069, that the attacker's entire toolkit is public. Before 2017, "the state has weapons the public does not" was a defensible line. EternalBlue erased it in the most spectacular way imaginable, and it established the pattern our systems now measure directly: the leaked or disclosed exploit becomes a permanent, cumulative public arsenal that never retires. Dossier 069C measured exactly this property on our own edge — exploits fired indefinitely, years after patch, the changelog that only grows. EternalBlue is why that changelog exists in the form it does. It is the reason ProxyShell and Log4Shell and every later disclosure slot into a permanent public corpus rather than fading: EternalBlue proved, at global scale, that a released exploit is a forever-exploit.

So our systems do not hold EternalBlue the specimen. They hold its descendants and its consequence — the ambient exploit weather of 2026, the never-emptying armory, the fact that a defender must now assume every attacker has every leaked state tool in their default kit. The floor we measure (069, 070) is standing on ground that EternalBlue helped pour. We catch the aftermath of the escape, which is the only part of a proliferation event that is ever catchable, because the escape itself is a one-time, one-way door.

6. The Caught Column

The alphabet's ledger asks: was anyone caught? For E, the answer splits in a revealing way.

The weaponizers were partly named. The GRU officers behind NotPetya were indicted (letter A's ledger — named, not arrested). Some WannaCry activity was attributed to North Korea. The leakers — the Shadow Brokers — were never definitively identified or apprehended; the group posted, taunted, and vanished.

But the deeper "caught" question for this letter is not about a person. It is about the decision that made the harm possible: the state's choice to hoard the vulnerability rather than disclose it. That decision has faced a kind of reckoning — the debate over "vulnerability equities," over whether agencies should keep zero-days for offense or report them for defense, is a direct product of 2017's twin leaks. WikiLeaks demanded exactly that debate in its Vault 7 statement. Whether the reckoning changed the behavior is a separate, unresolved question. What is certain is that the specific weapon, EternalBlue, will never be "caught," because it is not a fugitive. It is a public fact, permanently at large, and the only remaining defense against it is the same one that always applied: patch the protocol, and accept that the exploit for it will be scanned against you forever.

7. The Verdict

Set the leak beside the module and there is no reconciliation needed, because the module is the leak, frozen into a permanent public form.

• Did it end? No — it cannot. A leaked exploit is not a spent weapon; it is a permanently-copied one, and it is now in the default toolkit.
• Was anyone caught? The weaponizers were named (GRU indictment); the leakers vanished; the underlying decision to hoard got a debate. Consequence, but no recall.
• What did it become? Everything. A criminal ransomware worm, a state's infrastructure weapon, and — permanently — a free Metasploit module with the leakers in the byline.

Verdict: MUTATED, by proliferation. E gives the alphabet its most irreversible pattern. A diffused; B regenerated; C metastasized; D froze. E proliferated — passed through a one-way door that no takedown, indictment, or patch can close, because the thing that went through was not a physical object but a fact, and facts do not come back. WikiLeaks named it in 2017 with a precision the intervening years only confirmed: the uncontrolled proliferation of such weapons… a serious proliferation risk. The risk was real, the proliferation was total, and the weapon is, true to its name, eternal — not because it is sophisticated, but because a copied fact has no expiry.

And it leaves the alphabet with the darkest of its lessons about the "caught" column. Some harms escape prosecution because their authors are beyond reach (A). Some escape because they are too diffuse to grab (D). EternalBlue escaped consequence in a third way, the most permanent of all: it stopped being a thing that could be caught at all. You cannot arrest an exploit. You cannot extradite a byte sequence. Once the state's weapon became everyone's, it left the category of things that have a location, an owner, or a fate. It just persists, downloadable, in a library like ours, with the ghosts of the Shadow Brokers still credited in the author field.

8. Method Note — The Honest Limits

Three limits, stated plainly.

First, we do not catch EternalBlue on our wire. It is an SMB/445 weapon; our honeypot is SSH and our web-threats pipeline is HTTP. Every present-day claim in this letter rests on two honest supports: the verifiable fact that EternalBlue/DoublePulsar are standard Metasploit modules in our library (that we can read directly), and the measured pattern (069C) that leaked/disclosed exploits become a permanent public corpus. We do not claim a direct capture of EternalBlue, and this letter's bridge to the present is the arsenal it founded, not a sensor hit.

Second, damage figures are estimates. The ~$10 billion NotPetya figure is a widely-cited estimate, not an audited number; the DOJ indictment documents the specific hospital compromises with precision, and those we state as sourced fact, but the aggregate cost is inherently approximate.

Third, causation to the whole public-arsenal economy is a strong claim held with care. That EternalBlue founded and exemplifies the never-retires public arsenal is well-supported. That every later leaked-exploit dynamic descends specifically from these 2017 leaks, rather than from a broader disclosure-and-tooling culture that EternalBlue accelerated, is the weaker version, held at MEDIUM. As always: the vectors and the modules tell the truth about what is public now. The precise genealogy of the entire commons is a larger, softer question.

Investigation Metadata

Cross-references: TI-2026-071A (A is for APT — 'advanced became downloadable,' here made concrete; the GRU/Sandworm weaponizer) · TI-2026-069C (The Changelog — the never-retiring corpus EternalBlue founded) · TI-2026-069A/B (The Open Armory — the public toolkit) · TI-2026-071D (D is for Dota — the frozen commodity floor the arsenal now feeds).