All actors

The Shadow Brokers

Also reported as Shadow Brokers, The ShadowBrokers, TSB and ShadowBrokers. Linked to United States by one source.

Reports
65
Last reported
Known CVEs
35
Origin
United States
ID
the-shadow-brokers
Merge evidence
4 alias matches

Reports per quarter

  1. 2010 Q3: 1 report
  2. 2010 Q4: no reports
  3. 2011 Q1: no reports
  4. 2011 Q2: no reports
  5. 2011 Q3: no reports
  6. 2011 Q4: no reports
  7. 2012 Q1: no reports
  8. 2012 Q2: no reports
  9. 2012 Q3: no reports
  10. 2012 Q4: no reports
  11. 2013 Q1: no reports
  12. 2013 Q2: no reports
  13. 2013 Q3: no reports
  14. 2013 Q4: no reports
  15. 2014 Q1: no reports
  16. 2014 Q2: 2 reports
  17. 2014 Q3: no reports
  18. 2014 Q4: no reports
  19. 2015 Q1: no reports
  20. 2015 Q2: no reports
  21. 2015 Q3: no reports
  22. 2015 Q4: no reports
  23. 2016 Q1: no reports
  24. 2016 Q2: no reports
  25. 2016 Q3: 2 reports
  26. 2016 Q4: 5 reports
  27. 2017 Q1: 2 reports
  28. 2017 Q2: 14 reports
  29. 2017 Q3: 5 reports
  30. 2017 Q4: no reports
  31. 2018 Q1: 2 reports
  32. 2018 Q2: no reports
  33. 2018 Q3: no reports
  34. 2018 Q4: 1 report
  35. 2019 Q1: 1 report
  36. 2019 Q2: 3 reports
  37. 2019 Q3: 3 reports
  38. 2019 Q4: 2 reports
  39. 2020 Q1: 1 report
  40. 2020 Q2: 1 report
  41. 2020 Q3: no reports
  42. 2020 Q4: no reports
  43. 2021 Q1: 3 reports
  44. 2021 Q2: 3 reports
  45. 2021 Q3: no reports
  46. 2021 Q4: no reports
  47. 2022 Q1: 3 reports
  48. 2022 Q2: 1 report
  49. 2022 Q3: no reports
  50. 2022 Q4: no reports
  51. 2023 Q1: no reports
  52. 2023 Q2: 1 report
  53. 2023 Q3: no reports
  54. 2023 Q4: no reports
  55. 2024 Q1: no reports
  56. 2024 Q2: no reports
  57. 2024 Q3: no reports
  58. 2024 Q4: no reports
  59. 2025 Q1: 1 report
  60. 2025 Q2: no reports
  61. 2025 Q3: no reports
  62. 2025 Q4: no reports
  63. 2026 Q1: no reports
  64. 2026 Q2: 8 reports
Dated reports, 2010 Q3 to 2026 Q2.

Techniques seen in the last two years

Counts come from technique IDs in the actor's report text.

CVEs named in reports

Show all 35 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. DoublePulsar

    date ORKL added it fromORKL

Show all 65 reports Show fewer
  1. The Bvp47 - a Top-tier Backdoor of US NSA Equation Group

    date in the title fromORKL

  2. Glupteba back on track spreading via EternalBlue exploits

    date in the title fromORKL

  3. US Cyber Operations Groups

    date in the title fromORKL

  4. Microsoft Word - glupteba_final.docx

    file creation date fromORKL

  5. 2020_State-of-Malware-Report.pdf

    Malpedia library date fromORKL

  6. Wikipedia Entry on Equation Group

    date in the title fromORKL

  7. Equation Group

    Malpedia library date fromORKL

  8. UPSynergy_ Chinese-American Spy vs. Spy Story

    date in the CCS '25 data Check Point fromORKLCCS '25 data

  9. Buckeye_ Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak

    date in the CCS '25 data Symantec fromORKLCCS '25 data

  10. APT Trends report Q2 2017

    file creation date fromORKL

  11. Tildeb: Analyzing the 18-year-old Implant from the Shadow Brokers’ Leak

    Malpedia library date Trend Micro fromORKLCCS '25 data

  12. ukatemicrysys_territorialdispute

    Malpedia library date fromORKL

  13. Cisco - Annual Cybersecurity Report - 2018.pdf

    file creation date fromORKL

  14. EternalRocks (a.k.a. MicroBotMassiveNet)

    date in the title fromORKL

  15. How did the WannaCry ransomworm spread-

    date in the title fromORKL

  16. Wannacryptor Ransomworm

    date in the title fromORKL

  17. WannaCrypt ransomware worm targets out-of-date systems

    date in the title fromORKL

  18. EquationDrug rootkit analysis (mstcp32.sys)

    date in the title fromORKL

  19. AtomBombing_ A Code Injection that Bypasses Current Security Solutions

    date in the CCS '25 data enSilo fromORKLCCS '25 data

  20. Second Shadow Brokers dump released

    date in the title fromORKL

  21. The Shadow Brokers

    date in the title fromORKL

  22. The Shadow Brokers

    Malpedia library date fromORKL

  23. A quick analysis of the latest Shadow Brokers dump

    date in the title fromORKL

  24. Stuxnet

    Malpedia library date fromORKL

Newest first. Details opens the report in Explore.