- Category
- Agency or leak · A state agency’s own unit, or a toolset known from a leak.
- Origin
- United States(high confidence)
- Agency named
- NSA
- Motivation
- Financial gain
- Seen
- 2016
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0355 · the-shadow-brokers
United StatesWhat it is
The Shadow Brokers (TSB) is a hacker group who first appeared in the summer of 2016. They published several leaks containing hacking tools from the National Security Agency (NSA, including several zero-day exploits.[1] Specifically, these exploits and vulnerabilities targeted enterprise firewalls, antivirus software, and Microsoft products. The Shadow Brokers originally attributed the leaks to the Equation Group threat actor, who have been tied to the NSA's Tailored Access Operations unit.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Shadow Brokers, ShadowBrokers, The ShadowBrokers, TSB
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTUnited States
- ThreatActor.info (Malpedia et al.)United States
Tools
The tools and malware families the sources tie to it.
- Hacking Team UEFI Rootkit
- Virus RAT
- Xploit
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de