The Shadow Brokers

Also known as: Shadow Brokers, ShadowBrokers, TSB, The Shadow Brokers, The ShadowBrokers

The Shadow Brokers (TSB) is a hacker group who first appeared in the summer of 2016. They published several leaks containing hacking tools from the National Security Agency (NSA, including several zero-day exploits.[1] Specifically, these exploits and vulnerabilities targeted enterprise firewalls, antivirus software, and Microsoft products. The Shadow Brokers originally attributed the leaks to the Equation Group threat actor, who have been tied to the NSA’s Tailored Access Operations unit.

🌍 Country ["USA"]

Associated Operations

2016-08 2016-10 2017-03 2017-04 2017-09 Auction File Password In March 2017 Initial public dump Iranian targets New NSA leak may expose its bank spying Second Shadow Brokers dump released Shadow Brokers leaks show U.S. spies successfully hacked Russian ShadowBrokers Dump More Equation Group Hacks ShadowBrokers Release UNITEDRAKE Malware ShadowBrokers are back demanding nearly $4m and offering 2 dumps per month Windows exploits http://securityaffairs.co/wordpress/62770/hacking/shadowbrokers-return.html https://musalbas.com/blog/2016/08/16/equation-group-firewall-operations-catalogue.html https://securelist.com/darkpulsar/88199/ https://threatpost.com/shadowbrokers-dump-more-equation-group-hacks-auction-file-password/124882/ https://www.csoonline.com/article/3190055/new-nsa-leak-may-expose-its-bank-spying-windows-exploits.html https://www.cyberscoop.com/nsa-shadow-brokers-leaks-iran-russia-optimusprime-stoicsurgeon/ https://www.hackread.com/nsa-data-dump-shadowbrokers-expose-unitedrake-malware/ https://www.scmagazineuk.com/second-shadow-brokers-dump-released/article/1476023 https://www.vice.com/en_us/article/53djj3/shadow-brokers-whine-that-nobody-is-buying-their-hacked-nsa-files the ShadowBrokers published a chunk of stolen data that included two frameworks: DanderSpritz and FuzzBunch. ‘Shadow Brokers’ Whine That Nobody Is Buying Their Hacked NSA Files

Introduction

The Shadow Brokers (TSB) is a hacker group who first appeared in the summer of 2016. They published several leaks containing hacking tools from the National Security Agency (NSA, including several zero-day exploits.[1] Specifically, these exploits and vulnerabilities targeted enterprise firewalls, antivirus software, and Microsoft products. The Shadow Brokers originally attributed the leaks to the Equation Group threat actor, who have been tied to the NSA’s Tailored Access Operations unit.

Activities and Tactics

Country of Origin: 🏳️ [“USA”]

Notable Campaigns

  • 2016-08
  • 2016-10
  • 2017-03
  • 2017-04
  • 2017-09
  • Auction File Password
  • In March 2017
  • Initial public dump
  • Iranian targets
  • New NSA leak may expose its bank spying
  • Second Shadow Brokers dump released
  • Shadow Brokers leaks show U.S. spies successfully hacked Russian
  • ShadowBrokers Dump More Equation Group Hacks
  • ShadowBrokers Release UNITEDRAKE Malware
  • ShadowBrokers are back demanding nearly $4m and offering 2 dumps per month
  • Windows exploits
  • http://securityaffairs.co/wordpress/62770/hacking/shadowbrokers-return.html
  • https://musalbas.com/blog/2016/08/16/equation-group-firewall-operations-catalogue.html
  • https://securelist.com/darkpulsar/88199/
  • https://threatpost.com/shadowbrokers-dump-more-equation-group-hacks-auction-file-password/124882/
  • https://www.csoonline.com/article/3190055/new-nsa-leak-may-expose-its-bank-spying-windows-exploits.html
  • https://www.cyberscoop.com/nsa-shadow-brokers-leaks-iran-russia-optimusprime-stoicsurgeon/
  • https://www.hackread.com/nsa-data-dump-shadowbrokers-expose-unitedrake-malware/
  • https://www.scmagazineuk.com/second-shadow-brokers-dump-released/article/1476023
  • https://www.vice.com/en_us/article/53djj3/shadow-brokers-whine-that-nobody-is-buying-their-hacked-nsa-files
  • the ShadowBrokers published a chunk of stolen data that included two frameworks: DanderSpritz and FuzzBunch.
  • ‘Shadow Brokers’ Whine That Nobody Is Buying Their Hacked NSA Files

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Hacking Team UEFI Rootkit
  • Virus RAT
  • Xploit

Attribution and Evidence

Country of Origin: [“USA”] Additional attribution information pending cataloguing.

References

References pending cataloguing.