The Shadow Brokers
Also reported as Shadow Brokers, The ShadowBrokers, TSB and ShadowBrokers. Linked to United States by one source.
Reports per quarter
Techniques seen in the last two years
- T1070 1 report
Counts come from technique IDs in the actor's report text.
CVEs named in reports
- CVE-2010-2772
- CVE-2010-3962 KEV
- CVE-2011-3402 KEV
- CVE-2013-3128
- CVE-2013-3894
- CVE-2014-1776 KEV
- CVE-2015-2545 KEV
- CVE-2015-5119 KEV
- CVE-2016-0165 KEV
- CVE-2016-0984 KEV
- CVE-2016-1010 KEV
- CVE-2016-3393 KEV
Show all 35 CVEs Show fewer
- CVE-2016-4117 KEV ransomware
- CVE-2016-4171 KEV
- CVE-2017-0005 KEV
- CVE-2017-0108
- CVE-2017-0143 KEV ransomware
- CVE-2017-0144 KEV ransomware
- CVE-2017-0145 KEV ransomware
- CVE-2017-0199 KEV ransomware
- CVE-2017-0261 KEV
- CVE-2017-0262 KEV
- CVE-2017-0263 KEV
- CVE-2017-10271 KEV ransomware
- CVE-2017-3733
- CVE-2017-5638 KEV ransomware
- CVE-2017-7269 KEV
- CVE-2017-8759 KEV
- CVE-2017-9805 KEV
- CVE-2018-14847 KEV
- CVE-2019-0703 KEV
- CVE-2019-0803 KEV ransomware
- CVE-2019-18935 KEV ransomware
- CVE-2019-2725 KEV ransomware
- CVE-2019-3978
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor DoublePulsar
-
202304114e0fa0f4fd1d408aaddeef8be63a4757_20230411161526_0531.pdf
The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor 202304114e0fa0f4fd1d408aaddeef8be63a4757_20230411161526_0531.pdf
Show all 65 reports Show fewer
-
The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group_ii.en.pdf
The original link failed its last check. Original publisher Detailsfor The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group_ii.en.pdf
-
The Bvp47 - a Top-tier Backdoor of US NSA Equation Group
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Bvp47 - a Top-tier Backdoor of US NSA Equation Group
-
Chinese Experts Uncover Details of Equation Group's Bvp47 Covert Hacking Tool
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Chinese Experts Uncover Details of Equation Group's Bvp47 Covert Hacking Tool
-
The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en.pdf
The original link failed its last check. Original publisher Detailsfor The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en.pdf
-
Glupteba back on track spreading via EternalBlue exploits
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Glupteba back on track spreading via EternalBlue exploits
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor US Cyber Operations Groups
-
research.checkpoint.com-The Story of Jian How APT31 Stole and Used an Unknown Equation Group 0-Day
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor research.checkpoint.com-The Story of Jian How APT31 Stole and Used an Unknown Equation Group 0-Day
-
The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day
-
Microsoft Word - glupteba_final.docx
The original link failed its last check. Original publisher Detailsfor Microsoft Word - glupteba_final.docx
-
2020_State-of-Malware-Report.pdf
The original link failed its last check. Original publisher Detailsfor 2020_State-of-Malware-Report.pdf
-
Wikipedia Entry on Equation Group
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Wikipedia Entry on Equation Group
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Equation Group
-
Cryptocurrency miners aren’t dead yet- Documenting the voracious but simple “Panda”
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cryptocurrency miners aren’t dead yet- Documenting the voracious but simple “Panda”
-
UPSynergy_ Chinese-American Spy vs. Spy Story
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor UPSynergy_ Chinese-American Spy vs. Spy Story
-
Buckeye- Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Buckeye- Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak
-
Buckeye_ Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Buckeye_ Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak
-
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor APT Trends report Q2 2017
-
Tildeb: Analyzing the 18-year-old Implant from the Shadow Brokers’ Leak
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Tildeb: Analyzing the 18-year-old Implant from the Shadow Brokers’ Leak
-
ukatemicrysys_territorialdispute
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor ukatemicrysys_territorialdispute
-
Cisco - Annual Cybersecurity Report - 2018.pdf
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Cisco - Annual Cybersecurity Report - 2018.pdf
-
New NSA Data Dump- ShadowBrokers Release UNITEDRAKE Malware
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New NSA Data Dump- ShadowBrokers Release UNITEDRAKE Malware
-
ShadowBrokers are back demanding nearly $4m and offering 2 dumps per month
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ShadowBrokers are back demanding nearly $4m and offering 2 dumps per month
-
EternalRocks (a.k.a. MicroBotMassiveNet)
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor EternalRocks (a.k.a. MicroBotMassiveNet)
-
How did the WannaCry ransomworm spread-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor How did the WannaCry ransomworm spread-
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Wannacryptor Ransomworm
-
WannaCrypt ransomware worm targets out-of-date systems
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor WannaCrypt ransomware worm targets out-of-date systems
-
Shadow Brokers leaks show U.S. spies successfully hacked Russian, Iranian targets
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Shadow Brokers leaks show U.S. spies successfully hacked Russian, Iranian targets
-
ShadowBrokers Dump More Equation Group Hacks, Auction File Password
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ShadowBrokers Dump More Equation Group Hacks, Auction File Password
-
EquationDrug rootkit analysis (mstcp32.sys)
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor EquationDrug rootkit analysis (mstcp32.sys)
-
AtomBombing_ A Code Injection that Bypasses Current Security Solutions
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor AtomBombing_ A Code Injection that Bypasses Current Security Solutions
-
Second Shadow Brokers dump released
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Second Shadow Brokers dump released
-
‘Shadow Brokers’ Whine That Nobody Is Buying Their Hacked NSA Files
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ‘Shadow Brokers’ Whine That Nobody Is Buying Their Hacked NSA Files
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The Shadow Brokers
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor The Shadow Brokers
-
A quick analysis of the latest Shadow Brokers dump
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A quick analysis of the latest Shadow Brokers dump
-
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Stuxnet
Newest first. Details opens the report in Explore.