PRIMARY SOURCE DB
MITRE ATT&CK v15.1
Page built 2026-11-12
Data as of November 12, 2026 at 05:15 UTC
Search
KNOWN EXPLOITED VULNERABILITY DOSSIER

CVE-2017-0144

Microsoft · Windows SMBv1

SMBv1 server remote code execution flaw (EternalBlue) weaponized by military intelligence and cybercrime cartels in NotPetya and WannaCry.

CISA KEV Added: 2022-02-10
Severity Rating: Critical (CVSS 9.8)
Legal Indictments: 3 Cases
Catalog Status: Active KEV Mandate

Correlated Federal Court Cases & Exploitation Context (3)

Docket 2:20-cr-00316 · U.S. District Court for the Western District of Pennsylvania
U.S. v. Andrienko et al. (Sandworm / GRU Unit 74455)
fugitive

Six Russian Main Intelligence Directorate (GRU) military officers charged with deploying the NotPetya wiper, Olympic Destroyer malware, KillDisk attacks against Ukrainian power grids, and cyberattacks targeting French elections.

Exploitation Ground Zero: Supply-chain compromise of Ukrainian tax accounting software M.E.Doc (Intellect Service). Threat actors infiltrated the vendor's update infrastructure and backdoored the routine update binary ezvit.exe to deploy a malicious loader across thousands of corporate networks.
Operational Impact: Exceeded $10 billion in global economic damages. Paralyzed A.P. Moller-Maersk (shutting down 76 shipping terminals worldwide), FedEx TNT Express (permanently destroying tracking databases and causing $400M in losses), Merck Pharmaceuticals ($870M in losses), and Heritage Valley Health System (disrupting patient surgical suites and emergency rooms).
Sector: Energy, Healthcare, Government, Transportation · Loss: $10.0 billion Inspect Full Case Dossier →
Docket 2:18-mj-01479 · U.S. District Court for the Central District of California
U.S. v. Park Jin Hyok (Lazarus Group / Chosun Expo)
fugitive

Department of Justice charges North Korean state-sponsored programmer with the 2014 Sony Pictures hack, the 2017 global WannaCry ransomware outbreak, and the $81 million Bangladesh Bank cyber heist.

Exploitation Ground Zero: Targeted spearphishing emails with weaponized attachments targeting Sony Pictures Entertainment employees, followed by fraudulent SWIFT banking credentials targeting the Bangladesh Central Bank, and weaponization of EternalBlue in WannaCry.
Operational Impact: Extorted and destroyed Sony Pictures studio servers (forcing the cancellation of the theatrical premiere of The Interview); stole $81 million from the Bangladesh Central Bank via fraudulent SWIFT wire transfers; and paralyzed 300,000+ computers across 150 countries with WannaCry, forcing the UK National Health Service to divert emergency ambulances.
Sector: Media and Entertainment, Financial Services, Healthcare · Loss: $1.3 billion Inspect Full Case Dossier →
Docket 2:18-cr-00569 · U.S. District Court for the Central District of California
WannaCry Global Self-Propagating Ransomware Worm
charged

Global automated ransomware worm that weaponized the leaked NSA EternalBlue exploit (MS17-010) to self-propagate across 200,000 Windows computers in over 150 countries within hours, paralyzing 80 National Health Service (NHS) hospital trusts in the UK.

Exploitation Ground Zero: Automated network worm propagation exploiting the MS17-010 SMBv1 vulnerability (EternalBlue / DOUBLEPULSAR) against Internet-facing and internal TCP port 445 services without requiring user interaction.
Operational Impact: Infected over 200,000 computers across 150 countries within hours. Paralyzed the United Kingdom National Health Service (NHS), forcing hospital emergency ward diversions, canceling 19,000 medical appointments, and freezing operations at Renault, FedEx, and Deutsche Bahn, with estimated economic damages exceeding $4 billion.
Sector: Healthcare, Logistics, Critical Infrastructure · Loss: $4.0 billion Inspect Full Case Dossier →

Associated Government Advisories

Primary Reference Links

← Back to All CVEs Explore ATT&CK Matrix →