What's new

Closed Fact

Status
Not open for further replies.

Jmrie_

in memoriam 1995-2021
Joined
Aug 21, 2017
Posts
104,956
Solutions
1
Reaction
53,216
Points
27,061
Age
28
The Shadow Brokers (TSB) is a häçker group who first appeared in the summer of 2016.You do not have permission to view the full content of this post. Log in or register now.You do not have permission to view the full content of this post. Log in or register now. They published several leaks containing häçking tools from the You do not have permission to view the full content of this post. Log in or register now. (NSA), including several You do not have permission to view the full content of this post. Log in or register now..You do not have permission to view the full content of this post. Log in or register now.Specifically, these exploits and vulnerabilitiesYou do not have permission to view the full content of this post. Log in or register now.You do not have permission to view the full content of this post. Log in or register now. targeted enterprise You do not have permission to view the full content of this post. Log in or register now., You do not have permission to view the full content of this post. Log in or register now., and You do not have permission to view the full content of this post. Log in or register now.products.You do not have permission to view the full content of this post. Log in or register now. The Shadow Brokers originally attributed the leaks to the You do not have permission to view the full content of this post. Log in or register now. threat actor, who have been tied to the NSA's You do not have permission to view the full content of this post. Log in or register now. unit.You do not have permission to view the full content of this post. Log in or register now.You do not have permission to view the full content of this post. Log in or register now.You do not have permission to view the full content of this post. Log in or register now.You do not have permission to view the full content of this post. Log in or register now.


NameYou do not have permission to view the full content of this post. Log in or register now.
Several news sources noted that the group's name was likely in reference to a character from the You do not have permission to view the full content of this post. Log in or register now. video game series.You do not have permission to view the full content of this post. Log in or register now.You do not have permission to view the full content of this post. Log in or register now. You do not have permission to view the full content of this post. Log in or register now. quoted the following description of that character: "The Shadow Broker is an individual at the head of an expansive organization which trades in information, always selling to the highest bidder. The Shadow Broker appears to be highly competent at its trade: all secrets that are bought and sold never allow one customer of the Broker to gain a significant advantage, forcing the customers to continue trading information to avoid becoming disadvantaged, allowing the Broker to remain in business."You do not have permission to view the full content of this post. Log in or register now.


Leak historyYou do not have permission to view the full content of this post. Log in or register now.
First leak: "Equation Group Cyber Weapons Auction - Invitation"You do not have permission to view the full content of this post. Log in or register now.
While the exact date is unclear, reports suggest that preparation of the You do not have permission to view the full content of this post. Log in or register now. started at least in the beginning of August,You do not have permission to view the full content of this post. Log in or register now. and that the initial publication occurred August 13, 2016 with a Tweet from a You do not have permission to view the full content of this post. Log in or register now. account "@shadowbrokerss" announcing a You do not have permission to view the full content of this post. Log in or register now. pageYou do not have permission to view the full content of this post. Log in or register now. and a You do not have permission to view the full content of this post. Log in or register now. repository containing references and instructions for obtaining and decrypting the content of a file supposedly containing tools and exploits used by the You do not have permission to view the full content of this post. Log in or register now..

Publication and speculation about authenticityYou do not have permission to view the full content of this post. Log in or register now.
The PastebinYou do not have permission to view the full content of this post. Log in or register now. introduces a section titled "Equation Group Cyber Weapons Auction - Invitation", with the following content:

Equation Group Cyber Weapons Auction - Invitation

- ------------------------------------------------

!!! Attention government sponsors of cyber warfare and those who profit from it !!!!

How much you pay for enemies You do not have permission to view the full content of this post. Log in or register now.? Not malware you find in networks. Both sides, You do not have permission to view the full content of this post. Log in or register now. + LP, full state sponsor tool set? We find cyber weapons made by creators of You do not have permission to view the full content of this post. Log in or register now., You do not have permission to view the full content of this post. Log in or register now., You do not have permission to view the full content of this post. Log in or register now.. You do not have permission to view the full content of this post. Log in or register now. calls Equation Group. We follow Equation Group traffic. We find Equation Group source range. We häçk Equation Group. We find many many Equation Group cyber weapons. You see pictures. We give you some Equation Group files free, you see. This is good proof no? You enjoy!!! You break many things. You find many intrusions. You write many words. But not all, we are auction the best files. .

The Pastebin includes various references for obtaining the file, named "EQGRP-Auction-Files.zip". This You do not have permission to view the full content of this post. Log in or register now. contains seven files, two of which are the You do not have permission to view the full content of this post. Log in or register now.-encrypted archives "eqgrp-auction-file.tar.xz.gpg" and "eqgrp-free-file.tar.xz.gpg". The "eqgrp-free-file.tar.xz.gpg" archive's password was revealed in the original Pastebin to be theequationgroup. The "eqgrp-auction-file.tar.xz" archive's password was revealed in a later Medium post to be CrDj"(;Va.*NdlnzB9M?@K2)#>deB7mN.

The Pastebin continues with instructions for obtaining the password to the encrypted You do not have permission to view the full content of this post. Log in or register now. file:

Auction Instructions

- --------------------

We auction best files to highest bidder. Auction files better than stuxnet. Auction files better than free files we already give you. The party which sends most bitcoins to address: 19BY2XCgbDe6WtTVbTyzM9eR3LYr6VitWK before bidding stops is winner, we tell how to decrypt. Very important!!! When you send bitcoin you add additional output to transaction. You add OP_Return output. In Op_Return output you put your (bidder) contact info. We suggest use bitmessage or I2P-bote email address. No other information will be disclosed by us publicly. Do not believe unsigned messages. We will contact winner with decryption instructions. Winner can do with files as they please, we not release files to public.

The initial response to the publication was met with some skepticism,You do not have permission to view the full content of this post. Log in or register now. as to whether or not the content actually would be "...many many Equation Group cyber weapons."You do not have permission to view the full content of this post. Log in or register now.

Second leak: "Message #5 - TrickOrTreat"You do not have permission to view the full content of this post. Log in or register now.
This publication, made on October 31, 2016, contains a list of servers, supposedly compromised by Equation Group as well as references to seven supposedly undisclosed tools (DEWDROP, INCISION, JACKLADDER, ORANGUTAN, PATCHICILLIN, RETICULUM, SIDETRACK AND STOCSURGEON) also used by the threat actor.You do not have permission to view the full content of this post. Log in or register now.

Link to You do not have permission to view the full content of this post. Log in or register now.

Link to You do not have permission to view the full content of this post. Log in or register now. (Password = payus)

Third leak: "Message #6 - BLACK FRIDAY / CYBER MONDAY SALE"You do not have permission to view the full content of this post. Log in or register now.
Message #6 reads as follows:

TheShadowBrokers is trying auction. Peoples no like. TheShadowBrokers is trying crowdfunding. Peoples is no liking. Now TheShadowBrokers is trying direct sales. Be checking out ListOfwâréz. If you like, you email TheShadowBrokers with name of wâréz you want make purchase. TheShadowBrokers is emailing you back bitcoin address. You make payment. TheShadowBrokers emailing you link + decryption password. If not liking this transaction method, you finding TheShadowBrokers on underground marketplaces and making transaction with escrow. Files as always being signed.You do not have permission to view the full content of this post. Log in or register now.

This leakYou do not have permission to view the full content of this post. Log in or register now. contains 60 folders named in a way to serve as reference to tools likely used by Equation Group. The leak doesn't contain executable files, but rather screenshots of the tools file structure. While the leak could be a fake, the overall cohesion between previous and future leaks and references as well as the work required to fake such a fabrication, gives credibility to the theory that the referenced tools are genuine.

Fourth leak: "Don't Forget Your Base"You do not have permission to view the full content of this post. Log in or register now.
On April 8, 2017, the You do not have permission to view the full content of this post. Log in or register now. account used by The Shadow Brokers posted a new update.You do not have permission to view the full content of this post. Log in or register now. The post revealed the password to encrypted files released last year to be CrDj"(;Va.*NdlnzB9M?@K2)#>deB7mN. Those files allegedly reveal more NSA häçking tools.You do not have permission to view the full content of this post. Log in or register now. This posting explicitly stated that the post was partially in response to President Trump's You do not have permission to view the full content of this post. Log in or register now., which was also used by Russian forces.

The decrypted file, eqgrp-auction-file.tar.xz, contained a collection of tools primarily for compromising Linux/Unix based environments.You do not have permission to view the full content of this post. Log in or register now.

Fifth leak: "Lost in Translation"You do not have permission to view the full content of this post. Log in or register now.
On April 14, 2017, the You do not have permission to view the full content of this post. Log in or register now. account used by The Shadow Brokers posted a tweet with a linkYou do not have permission to view the full content of this post. Log in or register now. to a Steemit story. Herein, a message with a link to the leak files, encrypted with the password Reeeeeeeeeeeeeee.

The overall content is based around three folders: "oddjob", "swift" and "windows".You do not have permission to view the full content of this post. Log in or register now. The fifth leak is suggested to be the "...most damaging release yet"You do not have permission to view the full content of this post. Log in or register now. and CNN quoted Matthew Hickey saying, "This is quite possibly the most damaging thing I've seen in the last several years,".You do not have permission to view the full content of this post. Log in or register now.

The leak includes, amongst other things, the tools and exploits codenamed: DANDERSPIRITZ, ODDJOB, FUZZBUNCH, DARKPULSAR, ETERNALSYNERGY, ETERNALROMANCE, You do not have permission to view the full content of this post. Log in or register now., EXPLODINGCAN and EWOKFRENZY.You do not have permission to view the full content of this post. Log in or register now.You do not have permission to view the full content of this post. Log in or register now.You do not have permission to view the full content of this post. Log in or register now.

Some of the exploits targeting the Windows operating system, had been patched in a Microsoft Security Bulletin on March 14, 2017, one month before the leak occurred.You do not have permission to view the full content of this post. Log in or register now.You do not have permission to view the full content of this post. Log in or register now.Some speculated that Microsoft may have been tipped off about the release of the exploits.You do not have permission to view the full content of this post. Log in or register now.

ETERNALBLUEYou do not have permission to view the full content of this post. Log in or register now.
Main article: You do not have permission to view the full content of this post. Log in or register now.
Over 200,000 machines were infected with tools from this leak within the first two weeksYou do not have permission to view the full content of this post. Log in or register now. and in May 2017 the major You do not have permission to view the full content of this post. Log in or register now. used the ETERNALBLUE attack on You do not have permission to view the full content of this post. Log in or register now. (SMB) to spread itself.You do not have permission to view the full content of this post. Log in or register now. The exploit was also used to help carry out the You do not have permission to view the full content of this post. Log in or register now. on June 27, 2017.You do not have permission to view the full content of this post. Log in or register now.

ETERNALBLUE contains kernel shellcode to load the non-persistent You do not have permission to view the full content of this post. Log in or register now. You do not have permission to view the full content of this post. Log in or register now..You do not have permission to view the full content of this post. Log in or register now. This allows for the installation of the PEDDLECHEAP payload which would then be accessed by the attacker using the DanderSpritz Listening Post (LP) software.You do not have permission to view the full content of this post. Log in or register now.


Speculations and theories on motive and identityYou do not have permission to view the full content of this post. Log in or register now.
NSA insider threat / whistleblowerYou do not have permission to view the full content of this post. Log in or register now.
You do not have permission to view the full content of this post. Log in or register now. along with You do not have permission to view the full content of this post. Log in or register now. speculatedYou do not have permission to view the full content of this post. Log in or register now. that an insider, "possibly someone assigned to the [NSA’s] highly sensitive You do not have permission to view the full content of this post. Log in or register now.", stole the häçking tools.You do not have permission to view the full content of this post. Log in or register now.You do not have permission to view the full content of this post. Log in or register now. In October 2016, You do not have permission to view the full content of this post. Log in or register now. reported that You do not have permission to view the full content of this post. Log in or register now., a former contractor for You do not have permission to view the full content of this post. Log in or register now. accused of s†éáling approximately 50 terabytes of data from the You do not have permission to view the full content of this post. Log in or register now. (NSA), was the lead suspect. The Shadow Brokers continued posting messages that were cryptographically-signed and were interviewed by media while Martin was detained.You do not have permission to view the full content of this post. Log in or register now.

Theory on ties to RussiaYou do not have permission to view the full content of this post. Log in or register now.
You do not have permission to view the full content of this post. Log in or register now. stated on You do not have permission to view the full content of this post. Log in or register now. on August 16, 2016 that "circumstantial evidence and conventional wisdom indicates Russian responsibility"You do not have permission to view the full content of this post. Log in or register now. and that the leak "is likely a warning that someone can prove US responsibility for any attacks that originated from this malware server"You do not have permission to view the full content of this post. Log in or register now. summarizing that it looks like "somebody sending a message that an escalation in the attribution game could get messy fast".You do not have permission to view the full content of this post. Log in or register now.You do not have permission to view the full content of this post. Log in or register now.

You do not have permission to view the full content of this post. Log in or register now. put the incident in the context of the You do not have permission to view the full content of this post. Log in or register now. and häçking of the You do not have permission to view the full content of this post. Log in or register now.. As US intelligence agencies were contemplating counter-attacks, the Shadow Brokers code release was to be seen as a warning: "Retaliate for the D.N.C., and there are a lot more secrets, from the häçkings of the State Department, the White House and the Pentagon, that might be spilled as well. One senior official compared it to the scene in You do not have permission to view the full content of this post. Log in or register now. where the head of a favorite horse is left in a bed, as a warning."You do not have permission to view the full content of this post. Log in or register now.

list-of-equation-group-files-leaked-by-shadow-brokers-507546-2.png
 

Attachments

Status
Not open for further replies.

Similar threads

Back
Top