EternalBlue

EternalBlue exploited a flaw in Windows' file-sharing protocol to run code remotely with no user action, which lets malware spread on its own from machine to machine. The US intelligence agency had kept it for its own operations, and it was published by a group calling itself the Shadow Brokers. Microsoft had patched the flaw a month earlier, but hundreds of thousands of systems had not applied the fix, and that gap produced the two biggest cyber events of the year. For insurance, EternalBlue combines three questions in one: the insured's patching backlog, the accumulation of a single vector across thousands of victims, and attribution to a state, which fed the war exclusion litigation after NotPetya. It also shows that a weapon built by a government can escape its control and become everyone's risk.