The 2017 cyberattack that exploited the leaked EternalBlue tool and encrypted files worldwide was WannaCry.
WannaCry was a ransomware and computer worm outbreak that began on 12 May 2017. It exploited a vulnerability in Microsoft’s Server Message Block version 1 protocol, allowing it to spread between vulnerable Windows computers without requiring users to open a malicious attachment.
The exploit had been developed by the U.S. National Security Agency and later leaked by the Shadow Brokers. Microsoft had released a security update for supported systems before the outbreak, but many organizations had not applied it, and older unsupported versions of Windows remained exposed.
WannaCry displayed a ransom demand requesting payment in Bitcoin. The attack disrupted hospitals, businesses, telecommunications providers, and government agencies in many countries. It is often confused with NotPetya, which also caused major disruption in 2017 but was primarily destructive rather than a conventional ransomware campaign.