Follow the Access · 19 — The Wormable Exploit: The Self-Spreading Flaw and the Wiper Behind the Ransom Note

Follow the Access — Case 19. This register follows the intruder from the login prompt to the foothold's fate, and closes each case on what the access becomes: RANSOMED · MINED · PROXIED · HARVESTED · WIPED · RESOLD.

The IoT worm of the last case spread by guessing credentials — trying the factory password against every device it could reach. This case is about a worm that needs no credential at all, because it carries its own way in: a network exploit for a vulnerability in a widely-deployed service, which it uses to compromise the next machine directly, with no password to guess and no user to deceive. When such a worm finds a single unpatched host on a network, it does not stop there. It uses that host to exploit the next vulnerable machine, and the next, sweeping across the network at machine speed, taking an entire enterprise — every workstation, every server — from one foothold to total compromise in minutes. Nothing human sits in its path to slow it. It is the fastest-spreading vector in the register, and when its payload is destruction, it is the most catastrophic.

The engine of the two most damaging examples was a single exploit: EternalBlue, a weaponized flaw in Microsoft's SMB file-sharing protocol, leaked from a national intelligence arsenal in 2017. EternalBlue let a worm run code on unpatched Windows machines over the network with no authentication — the perfect propagation mechanism — and it armed both WannaCry, which spread across the globe in hours and crippled hospitals, and NotPetya, which used it to devastate networks worldwide. Years later, Log4Shell showed the same principle in a modern form: a critical flaw in Log4j, a logging library so ubiquitous it was buried, often unknowingly, inside a vast fraction of the world's software, triggering one of the largest mass-exploitation races ever seen. A wormable flaw in something deployed everywhere is not a product bug; it is a systemic event.

So the disposition is WIPED, and its defining case is the darkest in the entire register: NotPetya, which wore the costume of ransomware — encryption, a ransom note, a Bitcoin demand — but was in truth a wiper. Its encryption was irreversible by design. Its payment mechanism did not work. There was never a key. It did not want money; it wanted destruction, and the ransom note was camouflage. This is the case about the self-spreading flaw that cannot be aimed or recalled, and about the wiper that hid behind a ransom note to destroy ten billion dollars of the world while pretending to want to be paid.

1. The Worm That Carries Its Own Key

Begin with the mechanism that makes this vector so fast and so uncontrollable, because it is fundamentally different from every credential-based attack the register has followed. Those attacks needed to obtain access — to guess a password, phish a user, buy a login. This one needs nothing to obtain, because it brings its own access in the form of an exploit. A wormable exploit is a self-contained piece of code that, when sent to a vulnerable machine over the network, compromises it outright — the flaw is in a service the machine is running, and the exploit triggers that flaw to run the worm's code. No authentication is checked, because the vulnerability lives before authentication; the machine is taken simply because it is running the flawed service and is reachable.

The "wormable" part is what happens next. Having compromised one machine, the worm does not need a human to tell it where to go — it does what it is programmed to do: scan for other machines running the same vulnerable service, and exploit them the same way. Each newly compromised machine becomes a new launch point, exploiting its neighbors, which exploit theirs. And because this all happens through a software exploit rather than a credential guess, it happens at the full speed of the network, with no delays for lockouts or human decisions. A worm using a flaw in a common service can traverse a corporate network — which is typically full of the same operating systems running the same services — from a single entry point to near-total compromise in minutes. This is why EternalBlue was so devastating: SMB, the protocol it exploited, is everywhere in Windows networks, so a worm carrying EternalBlue could sweep an entire enterprise almost instantly, machine to machine, exploiting the same flaw on each.

The consequence that defines the case is a loss of control. A credential-based attacker chooses his targets and works them one at a time; he is in control of where his attack goes. A wormable exploit, once released, is not controlled by anyone — it goes wherever the vulnerability is, indiscriminately, exploiting every reachable machine running the flawed service regardless of who owns it or whether the attacker ever intended to hit it. The worm has no target list and no restraint; it has only a flaw to exploit and a network to cross, and it exploits and crosses until it runs out of vulnerable machines to reach. This uncontrollability is a nuisance when the payload is a miner. It is a catastrophe when the payload is a wiper — because then the attacker has released a self-replicating destroyer that will destroy everything it can reach, and cannot be called back.

2. EternalBlue and Log4Shell — When the Flaw Is Everywhere

Take the two defining examples in turn, because they show the wormable exploit at its most consequential and reveal what makes a flaw catastrophically wormable: ubiquity. A wormable exploit is only as dangerous as the vulnerability is common, and these two vulnerabilities were as common as vulnerabilities get.

EternalBlue exploited a flaw in SMB, the protocol Windows machines use to share files, which meant it targeted a service present and network-reachable on an enormous fraction of the world's computers. Worse, EternalBlue was not discovered by ordinary researchers — it was developed as a cyber-weapon by a national intelligence agency and then leaked, in 2017, into the public domain, handing a state-grade, no-authentication remote-code-execution exploit to anyone who wanted it. The results came within weeks. WannaCry, a ransomware worm carrying EternalBlue, spread across the globe in a matter of hours, encrypting machines in hospitals, businesses, and governments, its spread so fast and wide that it was halted less by defense than by the chance discovery of a kill-switch domain in its code. And then NotPetya, which the register will return to, used the same exploit to far more destructive effect. A single leaked exploit for a single SMB flaw drove two of the most damaging cyber events in history, because the flaw it exploited was running, unpatched, on machines everywhere.

Log4Shell, disclosed in late 2021, showed the same principle through a different and in some ways more frightening kind of ubiquity: a flaw not in an operating-system service but in a software component embedded, invisibly, inside countless other applications. Log4j is a logging library for Java — a small, unglamorous piece of infrastructure that developers include almost without thinking, and that ended up buried inside a vast fraction of the world's enterprise software, often without the people running that software even knowing it was there. When a critical, trivially-exploitable remote-code-execution flaw was found in it, the disclosure triggered one of the largest mass-exploitation events ever recorded, as attackers raced to hit every exposed system — and defenders raced to even discover which of their systems contained the vulnerable library, buried as it was inside applications they had not written. Log4Shell is the reminder that the wormable flaw of the future may not be in a product you can see and patch, but in a component embedded everywhere inside things you did not know contained it — a systemic vulnerability in the supply chain of software itself, exploitable at internet scale the moment it is known.

3. WIPED — The Wiper Wearing the Ransom Note

Now the disposition, and NotPetya earns it as the register's starkest single case, because it is not merely destructive but deceptive about its own nature — a wiper disguised as a ransom, which is a category of attack that distorts everything about how it is understood and answered. To see why the disposition is WIPED and not RANSOMED, you have to look past what NotPetya pretended to be and at what it actually did.

On its surface, NotPetya looked exactly like ransomware. It encrypted the machines it compromised, rendering them unusable, and it displayed a ransom note — the familiar screen demanding a payment in Bitcoin in exchange for the key to decrypt the data. A victim seeing that screen would reasonably conclude they had been ransomed, and that paying might restore their systems. But every part of that presentation was a lie. NotPetya's encryption was not designed to be reversible — analysis showed it destroyed data in ways that could not be undone even by its own authors, overwriting rather than merely locking. Its payment and recovery mechanism was non-functional: the channel through which a victim was supposed to receive their key after paying did not actually work, and in any case there was no key, because the malware never retained the information needed to decrypt. NotPetya was not a locked box awaiting payment; it was a shredder that displayed a ransom note. Its true purpose was destruction, and the ransom demand was pure camouflage — a costume worn by a destructive attack to make it look like ordinary crime.

This is why the register records the disposition as WIPED. RANSOMED means the data is held hostage, recoverable in principle by paying or by restoring from backup — the attacker wants money, and the destruction is leverage. WIPED means the data is gone, destroyed, unrecoverable except from a copy made beforehand — the attacker wants ruin, and any pretense of extortion is a lie. NotPetya was the second, wearing the mask of the first. The victims who paid its ransom received nothing, not because the attacker chose not to help them but because there was nothing to receive and never had been. And the deception was not incidental; it was strategic. By dressing destruction as extortion, NotPetya's authors robbed victims of the correct response — a victim who thinks they can pay to recover will wait for a key that will never come, delaying the restore-from-backup that was their only real hope — and simultaneously laundered a destructive, nation-state-attributed operation as a piece of ordinary criminal ransomware, muddying the world's understanding of what had actually happened and who had done it. The ransom note over the wiper is a double deception: it deceives the victim about their options and it deceives the world about the attack's nature. Recognizing when a "ransomware" event is actually a wiper is, as NotPetya proved, a real and consequential analytic task, because getting it wrong means paying a shredder and waiting for a key from a machine that keeps no keys.

4. The Weapon That Cannot Be Aimed

Pause on the property that makes the self-spreading wiper uniquely dangerous among everything in the register, because it is the point where cybercrime becomes something closer to an uncontrolled weapon: NotPetya could not be aimed, and could not be recalled. It was, by most public assessment, a nation-state operation with an initial target — it was seeded through a compromised update of accounting software widely used in one particular country, apparently to strike that country's organizations. Had it stayed there, it would have been a targeted destructive attack. But it did not stay there, because it was a worm, and a worm goes wherever the vulnerability is.

Once NotPetya took hold in its initial targets, its wormable propagation — using EternalBlue and credential theft to spread machine-to-machine — carried it far beyond any intended boundary. It leapt from the initial targets into the global networks of multinational corporations that had any connection to them: shipping and logistics giants, pharmaceutical companies, manufacturers, food producers, whose operations were paralyzed as the worm swept their networks and destroyed their machines. The total damage was estimated at around ten billion dollars worldwide, making it one of the costliest cyberattacks in history — and the overwhelming majority of that damage fell on organizations that were never the intended target, that had no connection to the geopolitical conflict behind the attack, and that were destroyed simply because the worm reached them. Reporting even indicated that the attack boomeranged onto organizations aligned with its likely author, harming interests on its own side, because the worm did not know whose machines it was destroying and did not care. It destroyed everything it could reach, and everything it could reach turned out to be far, far more than anyone intended.

This is the register's gravest lesson about the wormable destructive payload, and it generalizes beyond NotPetya: a self-spreading destructive weapon cannot be controlled by its creator once released. Every other attack in the register is, in some sense, directed — an operator chooses targets, works them, decides how far to go. The self-propagating wiper removes the operator from the loop after launch; it spreads and destroys autonomously, bounded only by the reach of the vulnerability, which in a connected world is nearly unbounded. The attacker who releases such a thing is not conducting an operation; he is setting off a chain reaction, and chain reactions do not respect the intentions of the person who started them. NotPetya is the proof that in a networked world, a destructive worm is closer to a biological weapon than a burglary — it escapes containment, crosses every border, and harms indiscriminately, including, sometimes, the very side that made it. That is a category of danger the register must name plainly, because it is the point at which an access vector stops being crime and becomes something with the character of a weapon of mass disruption, loosed and beyond recall.

5. Patch at the Speed of a Worm, and Keep the Backup Offline

The register owes the defense, and the wormable exploit demands the harshest and most time-critical version of advice the register has given repeatedly, plus one measure that is, against a wiper, not optional but total. The defense has three parts: outrun the worm, contain the worm, and survive the worm.

Outrunning it means patching at the speed a worm spreads, which is to say immediately. When a wormable remote-code-execution flaw in a widely-deployed service is disclosed — an EternalBlue, a Log4Shell — there is no grace period, because a worm gives none: mass exploitation begins within hours of disclosure, sometimes before, and every unpatched machine is a potential entry point and propagation node. This is the most urgent patching imperative in the entire register, because unlike a targeted exploit that an attacker must choose to use against you, a worm will come to every vulnerable machine automatically. The organizations devastated by WannaCry and NotPetya were, overwhelmingly, those that had not applied the SMB patch that Microsoft had, in fact, released before the attacks — the fix existed, and the worm found the machines that had not taken it. Containing the worm means network segmentation: if a worm enters through one host but the network is divided into isolated segments, it cannot sweep the whole estate, because it cannot reach most of the machines from where it landed. Flat networks — where every machine can talk to every other — are exactly what let NotPetya and WannaCry spread so catastrophically far, and segmentation is what would have bounded them. Restricting or disabling exposed legacy services like SMB where they are not needed removes the flaw's reachability entirely.

And surviving the worm — when it is a wiper — comes down to one thing: backups. This is the measure that is optional against most vectors and absolute against this one, because a wiper offers no other path to recovery. Against ransomware, you might pay and recover; against a wiper wearing a ransom note, paying returns nothing, because there is no key, so the data destroyed is gone unless a copy was made beforehand. Tested, offline, immutable backups — copies the worm cannot reach to destroy, and cannot corrupt because they are write-protected — are the entire survival plan against a self-spreading wiper. Not a fallback, not a supplement: the whole plan. NotPetya's victims who survived were those who could rebuild from clean backups; those who could not lost the data permanently. The register's defensive summary for this vector is therefore stark: patch faster than a worm can spread, segment so it cannot spread far, and keep the backups where it cannot reach them — because against a weapon that destroys everything it touches and cannot be paid to stop, the only defense is to have already put a copy of your world somewhere it cannot go.

6. The counter-narrative, steelmanned

The strongest objection to this case is that it dwells on a historical peak — that EternalBlue was patched years ago, that NotPetya was a once-in-a-decade nation-state event, and that the wormable exploit is a fading threat kept alive by dramatic war stories.

The argument runs like this. EternalBlue is old news; the SMB flaw was patched in 2017, the vulnerable machines have largely aged out, and the specific exploit that drove WannaCry and NotPetya no longer finds the vast unpatched population it once did. NotPetya, the objection continues, was an extraordinary geopolitical event — a nation-state destructive operation seeded through a specific country's software — not a repeatable criminal pattern, and treating it as representative overstates how often wipers-behind-ransom-notes actually occur. Modern operating systems are better hardened, networks are more often segmented, and the industry learned the lessons of 2017. On this view the wormable exploit is a solved historical problem, and the case is fighting a war that ended when the SMB patch shipped.

The register grants that the specific flaws are patched and denies that the vector is closed. Yes, EternalBlue's population has shrunk and the industry learned real lessons — segmentation and rapid patching are more common than they were, which is genuine progress. But the wormable exploit is not a specific flaw; it is a category, and the category is refreshed every time a critical remote-code-execution vulnerability is found in a widely-deployed service or component — which continues to happen. Log4Shell, four years after EternalBlue, proved the pattern was alive and if anything worse, because the flaw was buried invisibly inside countless applications, making it harder to even find than a named product bug. The next wormable flaw is not a question of if but when and where, and the case's lessons — patch at worm speed, segment, keep offline backups, and recognize a wiper behind a ransom note — are general defenses against a recurring category, not a post-mortem of one event. And the NotPetya-as-anomaly claim understates the ongoing danger: destructive wipers disguised as ransomware have recurred in subsequent conflicts, precisely because the disguise is strategically useful, and the analytic task of distinguishing wiper from ransomware remains live and consequential every time a major "ransomware" event hits critical infrastructure in a geopolitical hotspot. The wormable exploit earns its case not as history but as the register's clearest study of two enduring dangers: the self-spreading flaw that cannot be aimed, and the destruction that hides behind a demand for money. Both will return, because the conditions that produce them — ubiquitous software and useful deception — are permanent.

7. Disposition — WIPED

Case 19 followed the wormable network exploit — the self-propagating vulnerability that spreads by flaw rather than by credential, carrying its own way in and sweeping unpatched networks machine-to-machine at machine speed, with nothing human in its path. EternalBlue, the leaked SMB exploit, armed both WannaCry and NotPetya; Log4Shell showed the modern form, a wormable flaw buried invisibly inside a vast fraction of the world's software. The vector's defining property is loss of control: released, the worm goes wherever the vulnerability is, indiscriminately, and cannot be aimed or recalled.

The disposition — the foothold's fate — is WIPED, and its defining case is NotPetya: a wiper wearing the costume of ransomware. It encrypted machines and demanded a Bitcoin ransom, but its encryption was irreversible, its payment mechanism fake, and its key nonexistent — it wanted destruction, not money, and the ransom note was camouflage that robbed victims of the correct response and laundered a destructive nation-state operation as ordinary crime. Aimed at one country, it boomeranged across the globe into multinationals that were never targets, causing an estimated ten billion dollars in damage and harming even organizations aligned with its likely author — the register's clearest proof that a self-spreading destructive payload is closer to an uncontrolled weapon than a crime.

The defense is the register's harshest and most absolute: patch a disclosed wormable flaw at emergency speed everywhere, because a worm gives no grace period; segment networks so a worm that enters cannot sweep the whole estate, since flat networks are what let NotPetya spread so far; restrict exposed legacy services; and — because a wiper cannot be paid to give back what it destroyed — keep tested, offline, immutable backups as not a fallback but the entire survival plan. The vectors do not lie: the flaw was everywhere, the worm carried its own key, it swept the network in minutes and destroyed everything it touched, and the ransom note on the screen was a lie over a shredder — a demand for money from an attacker who only ever wanted ruin. We do not judge. We record. We let people judge — and then, if they are wise, patch before the worm arrives, and keep a copy of the world where the worm cannot reach it.

Follow the Access continues. Case 19 disposition: WIPED. Confidence: HIGH — EternalBlue (CVE-2017-0144), WannaCry, and NotPetya are extensively documented in public reporting and government attribution, including NotPetya's wiper nature (irreversible encryption, non-functional payment mechanism), its ~$10 billion global toll, and its uncontrolled spread beyond its intended target; Log4Shell (CVE-2021-44228) and its mass-exploitation event are equally public. The WIPED-vs-RANSOMED distinction is the case's analytic core and is grounded in the documented technical analysis of NotPetya. The self-spreading-weapon uncontrollability lesson connects to the IoT worm (Case 18, credential-spread) as the exploit-spread counterpart. The emergency-patch/segmentation/offline-backup defense follows CISA and standard practice. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the flaw that was everywhere, the worm that could not be recalled, and the ransom note that was a lie over a shredder.