The Shadow Brokers (TSB) are ahacker group that emerged during the summer of 2016.[1][2] They published several leaks containing hacking tools, including severalzero-day exploits,[1] from the "Equation Group" who are widely suspected to be a branch of theNational Security Agency (NSA) of the United States.[3][4] Specifically, these exploits and vulnerabilities[5][6] targeted enterprisefirewalls,antivirus software, andMicrosoft products.[7] The Shadow Brokers originally attributed the leaks to the Equation Group threat actor, who have been tied to the NSA'sTailored Access Operations unit.[8][9][10][4]
Several news sources noted that the group's name was likely in reference to a character from theMass Effect video game series.[11][12]Matt Suiche quoted the following description of that character: "The Shadow Broker is an individual at the head of an expansive organization which trades in information, always selling to the highest bidder. The Shadow Broker appears to be highly competent at its trade: all secrets that are bought and sold never allow one customer of the Broker to gain a significant advantage, forcing the customers to continue trading information to avoid becoming disadvantaged, allowing the Broker to remain in business."[13]
While the exact date is unclear, reports suggested that the preparation of theleak started at least in the beginning of August,[14] and that the initial publication occurred August 13, 2016 with a Tweet from aTwitter account "@shadowbrokerss" announcing aPastebin page[6] and aGitHub repository containing references and instructions for obtaining and decrypting the content of a file supposedly containing tools and exploits used by theEquation Group. The initial response to the publication was met with some uncertainty about its authenticity.[15]
On October 31, 2016, The Shadow Brokers published a list of servers supposedly compromised by the Equation Group, as well as references to seven supposedly undisclosed tools (DEWDROP, INCISION, JACKLADDER, ORANGUTAN, PATCHICILLIN, RETICULUM, SIDETRACK AND STOICSURGEON) also used by the threat actor.[16]
On April 8, 2017, theMedium account used by The Shadow Brokers posted a new update.[17] The post revealed the passwordCrDj”(;Va.*NdlnzB9M?@K2)#>deB7mN to encrypted files released the previous year, which allegedly had moreNSA hacking tools.[18] This posting explicitly stated that the post was partially in response to President Trump'sattack against a Syrian airfield, which was also used byRussian forces.
On April 14, 2017, The Shadow Brokers released, amongst other things, the tools and exploits codenamed: DANDERSPRITZ, ODDJOB, FUZZBUNCH, DARKPULSAR, ETERNALSYNERGY, ETERNALROMANCE,ETERNALBLUE, EXPLODINGCAN and EWOKFRENZY.[19][20][21]
The leak was suggested to be the "most damaging release yet"[19] andCNN quoted Matthew Hickey saying, "This is quite possibly the most damaging thing I've seen in the last several years".[22]
Some of the exploits targeting theMicrosoft Windows operating system had been patched in a Microsoft Security Bulletin on March 14, 2017, a month before the leak occurred.[23][24] Some speculated thatMicrosoft may have been tipped off by theNSA about the release of the exploits.[25]
Over 200,000 systems were infected with tools from this leak within the first two weeks,[26] and in May 2017, the majorWannaCry ransomware attack used the ETERNALBLUE exploit onServer Message Block (SMB) to spread itself.[27] The exploit was also used to help carry out the2017 NotPetya cyberattack on June 27, 2017.[28]
ETERNALBLUE contains kernel shellcode to load the non-persistentDoublePulsarbackdoor.[29] This allows for the installation of the PEDDLECHEAP payload which would then be accessed by the attacker using the DanderSpritz Listening Post (LP) software.[30][31]
James Bamford along withMatt Suiche speculated[32] that an insider, "possibly someone assigned to the [NSA's] highly sensitiveTailored Access Operations", stole the hacking tools.[33][34] In October 2016,The Washington Post reported thatHarold T. Martin III, a former contractor forBooz Allen Hamilton accused of stealing approximately 50 terabytes of data from theNational Security Agency (NSA), was the lead suspect. Martin had worked with the NSA's Tailored Access Operations from 2012 to 2015 in a support role. He pleaded guilty to retaining national defense information in 2019, but it is not clear whether the Shadow Brokers obtained their material from him. The Shadow Brokers continued posting messages that were cryptographically-signed and were interviewed by media while Martin was detained.[35]
Edward Snowden stated onTwitter on August 16, 2016 that "circumstantial evidence andconventional wisdom indicates Russian responsibility"[36] and that the leak "is likely a warning that someone can prove US responsibility for any attacks that originated from this malware server"[37] summarizing that it looks like "somebody sending a message that an escalation in the attribution game could get messy fast".[38][39]
The New York Times put the incident in the context of theDemocratic National Committee cyber attacks and hacking of thePodesta emails. AsUS intelligence agencies were contemplating counter-attacks, the Shadow Brokers code release was to be seen as a warning: "Retaliate for the D.N.C., and there are a lot more secrets, from the hackings of theState Department, theWhite House and thePentagon, that might be spilled as well. One senior official compared it to the scene inThe Godfather where the head of a favorite horse is left in a bed, as a warning."[40]
In 2019, David Aitel, a computer scientist formerly employed by theNSA, summarized the situation with: "I don't know if anybody knows other than the Russians. And we don't even know if it's the Russians. We don't know at this point; anything could be true."[41]