‘Shadow Brokers’ Claim to be Selling NSA Malware, in What Could Be Historic Hack 
 
 A mysterious online group calling itself “The Shadow Brokers” is claiming to have penetrated the National Security Agency, stolen some of its malware, and is auctioning off the files to the highest bidder. 
 
 The authenticity of the files cannot be confirmed but appear to be legitimate, according to security researchers who have studied their content. Their release comes on the heels of a series of disclosures of emails and documents belonging mostly to Democratic officials, but also to Republicans. Security researchers believe those breaches were perpetrated by agents thought to be acting on behalf of Moscow. 
 
 The NSA did not answer Foreign Policy’s questions about the alleged breach on Monday. But if someone has managed to penetrate the American signals intelligence agency and post its code online for the world to see — and purchase — it would constitute a historic black eye for the agency. 
 
 “It’s at minimum very interesting; at maximum, hugely damaging,” said Dave Aitel, a former NSA research scientist and now the CEO of the security firm Immunity. “It’ll blow some operations if those haven’t already been blown.” 
 
 The files posted over the weekend include two sets of files. The hackers have made one set available for free. The other remains encrypted and is the subject of an online auction, payable in bitcoin, the cryptocurrency. That set includes, according to the so-called Shadow Brokers, “the best files.” If they receive at least 1 million bitcoin — the equivalent of at least $550 million — they will post more documents and make them available for free. 
 
 The set of files available for free contains a series of tools for penetrating network gear made by Cisco, Juniper, and other major firms. Targeting such gear, which includes things like routers and firewalls, is a known tactic of Western intelligence agencies like the NSA, and was documented in the Edward Snowden files. Some code words referenced in the material Monday — BANANAGLEE and JETPLOW — match those that have appeared in documents leaked by Snowden. Security researchers analyzing the code posted Monday say it is functional and includes computer codes for carrying out espionage. 
 
 The Equation Group is a collection of hackers whose activities were first documented by Kaspersky Lab, a Russian cybersecurity firm, last year. Kaspersky connected the activities of the Equation Group, which it called “a threat actor that surpasses anything known in terms of complexity and sophistication of techniques,” to operations carried out by U.S. intelligence. While Kaspersky did not outright attribute the Equation Group to the NSA, security researchers say in private that they believe it is a project of the American signals intelligence unit. 
 
 If the leak is a genuine sample of NSA code — which, so far, researchers say is the case — then this month’s season of information warfare has taken yet another bizarre turn. In the span of several weeks, Russian hackers have posted hacked emails and other documents on a mysterious site known as DCLeaks.com. Those same hackers have infiltrated the Democratic National Committee, and then likely fed documents exfiltrated from its servers to WikiLeaks. Those documents ignited a major political firestorm within the DNC on the eve of the party’s presidential nominating convention, led to the resignation of party chief Debbie Wasserman Schultz, and prompted the Clinton campaign to argue that Moscow was intervening in the election in favor of Moscow-friendly Republican nominee Donald Trump. 
 
 To muddy the waters, a persona calling itself Guccifer 2.0 — and which intelligence agencies and security researchers say is a Russian invention — has surfaced to take credit for the attack on the DNC and other political institutions. On Monday, he posted his latest set of pilfered documents: internal assessments of Florida congressional races obtained from the Democratic Congressional Campaign Committee. 
 
 In a Twitter message to Foreign Policy, Guccifer 2.0 called the Shadow Broker dump “bullshit” but wouldn’t elaborate on what he meant. “The hacking world operates differently,” he said. 
 
 So is Russia also responsible for this alleged penetration of the NSA? Aitel believes that it is, and that we are witnessing a small part of the shadow war playing out between Washington and Moscow. 
 
 On the heels of the DNC breach, a chorus of American politicians has called for the United States to respond, and Aitel believes that the posting of NSA may be an escalating conflict in cyberspace between the two powers. 
 
 In a note along with the files, the Shadow Brokers come across as merry pranksters with a distinctly populist set of political ideas. “We follow Equation Group traffic. We find Equation Group source range. We hack Equation Group. We find many many Equation Group cyber weapons. You see pictures. We give you some Equation Group files free, you see. This is good proof no? You enjoy!!! You break many things. You find many intrusions. You write many words. But not all, we are auction the best files.” 
 
 The group delivered a message to what it called “wealthy elites” and assailed the integrity of elections. “Elites is making laws protect self and friends, lie and fuck other peoples,” they wrote in idiosyncratic English. “Then Elites runs for president. Why run for president when already control country like dictatorship?” 
 
 “We want make sure Wealthy Elite recognizes the danger cyber weapons, this message, our auction, poses to their wealth and control. Let us spell out for Elites,” the group added. “Your wealth and control depends on electronic data.” 
 
 A penetration of an NSA tool of this kind, which Aitel said is similar to what an NSA agent would see when carrying out cyber operations, would probably require the tools of hackers working on behalf of nation-state because the agency is typically careful in hiding its tools and using computer defenses. 
 
 The goal of the operation remains something of a mystery. The files appear to be from late 2013 — after the Snowden revelations — in which case whoever burned this NSA operation has been sitting on explosive government files for some three years. Why post these documents now? And to what end? 
 
 Those questions are probably being debated in the White House, where a spokesman declined to answer questions on what may go down in history as a landmark day in the history of cyberwarfare. 
 
 Photo credit: NSA via Getty Images ||||| In what security experts say is either a one-of-a-kind breach or an elaborate hoax, an anonymous group has published what it claims are sophisticated software tools belonging to an elite team of hackers tied to the US National Security Agency. 
 
 Further Reading How “omnipotent” hackers tied to NSA hid for 14 years—and were found at last In a recently published blog post, the group calling itself Shadow Brokers claims the leaked set of exploits were obtained after members hacked Equation Group (the post has since been removed from Tumblr, but a cached version here was still available as this post was going live). Last year, Kaspersky Lab researchers described Equation Group as one of the world's most advanced hacking groups, with ties to both the Stuxnet and Flame espionage malware platforms. The compressed data accompanying the Shadow Broker post is slightly bigger than 256 megabytes and purports to contain a series of hacking tools dating back to 2010. While it wasn't immediately possible for outsiders to prove the posted data—mostly batch scripts and poorly coded python scripts—belonged to Equation Group, there was little doubt the data has origins with some advanced hacking group. 
 
 
 
 
 
 
 
 Not fully fake 
 
 "These files are not fully fake for sure," Bencsáth Boldizsár, a researcher with Hungary-based CrySyS who is widely credited with discovering Flame, told Ars in an e-mail. "Most likely they are part of the NSA toolset, judging just by the volume and peeps into the samples. At first glance it is sound that these are important attack related files, and yes, the first guess would be Equation Group." 
 
 Further Reading Guccifer 2.0 doxes hundreds of House Democrats with massive document dump The Shadow Broker post came the same day that Guccifer 2.0, the online persona behind high-profile hacks of the Democratic National Committee and the Democratic Congressional Campaign Committee, posted a new batch of private material purportedly taken during the breach of the latter Democratic group. Monday's Guccifer post came on the heels of Friday's separate document dump that leaked a massive amount of personal data belonging to every Democratic member of the US House of Representatives. 
 
 Taken together, the three posts, and several earlier Guccifer 2.0 dispatches, represent a major broadside against US interests, although it’s impossible to directly connect the people behind the two online personas. Shadow Brokers’ post also differed in that it was offering to auction off the stolen data in exchange for a payment reaching one million Bitcoins (current value is more than $500 million). (The 256 MB of data included in Monday’s post was offered as a small sample of what Shadow Brokers had acquired.) Many researchers doubt the group has any hope of selling the data. As international tensions over hacking remain high, those experts speculate the true aim of Shadow Brokers is to discredit and embarrass the US government and its intelligence apparatus. 
 
 Many researchers similarly doubt the data was acquired during a direct hack of Equation Group networks. Instead, researchers speculate the data came after breaching a command-and-control channel server used by a hacking group. 
 
 Samples of the stolen files are dated most recently to 2013 and contain implants, exploits, and other tools for controlling routers and firewalls, including those from Cisco Systems, Juniper, Fortigate, and China-based Topsec, according to this analysis from Matt Suiche, cofounder and CEO of security firm Comae Technologies. A separate analysis from firm Risk Based Security noted that an IP address in an exploit labeled "ESPL: ESCALATEPLOWMAN" contained an IP address belonging to the US Department of Defense. 
 
 Using broken English, Shadow Brokers posted the following: 
 
 We follow Equation Group traffic. We find Equation Group source range. We hack Equation Group. We find many many Equation Group cyber weapons. You see pictures. We give you some Equation Group files free, you see. This is good proof no? You enjoy!!! You break many things. You find many intrusions. You write many words. But not all, we are auction the best files. 
 
 At the same time, the Risk Based Security post cautioned that so-called false-flag operations—in which attackers manufacture evidence that falsely implicates others—is a regular occurrence in hacking campaigns, particularly those sponsored by nations. If the claims in the Shadow Brokers’ post are true, this may be one of the only publicly known times the NSA has been compromised. But even if the claims turn out to be exaggerated, the Shadow Brokers’ post is significant, if only for the amount of work and planning that went into fabricating evidence to provoke one of the world’s most advanced hacking operations. ||||| Pastebin PRO Accounts SUMMER SPECIAL! For a limited time only get 40% discount on a Offer Ends Soon! For a limited time only geton a LIFETIME PRO account! 
 
 SHARE TWEET Equation Group - Cyber Weapons Auction a guest Aug 13th, 2016 485 Never a guest485Never 
 
 rawdownloadcloneembedreportprint text 6.64 KB -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 From: bitmessage = BM-NBvAHfp5Y6wBykgbirVLndZtEFCYGht8 i2p-bote = o1uHOkOcMoFEa7O7dbEilzfMvWzo7bDu~td3x9gYz4b4t5OriJ7U6GUWr5GZoWxQ9f2TrIY5RzhpIMVP6hTLXZ ﻿Equation Group Cyber Weapons Auction - Invitation - ------------------------------------------------ !!! Attention government sponsors of cyber warfare and those who profit from it !!!! How much you pay for enemies cyber weapons? Not malware you find in networks. Both sides, RAT + LP, full state sponsor tool set? We find cyber weapons made by creators of stuxnet, duqu, flame. Kaspersky calls Equation Group. We follow Equation Group traffic. We find Equation Group source range. We hack Equation Group. We find many many Equation Group cyber weapons. You see pictures. We give you some Equation Group files free, you see. This is good proof no? You enjoy!!! You break many things. You find many intrusions. You write many words. But not all, we are auction the best files. Picture Urls - ------------ http://imgur.com/a/sYpyn https://theshadowbrokers.tumblr.com/ https://github.com/theshadowbrokers/EQGRP-AUCTION File Urls - ---------- magnet:?xt=urn:btih:40a5f1514514fb67943f137f7fde0a7b5e991f76&tr=http://diftracker.i2p/announce.php https://mega.nz/#!zEAU1AQL!oWJ63n-D6lCuCQ4AY0Cv_405hX8kn7MEsa1iLH5UjKU https://app.box.com/s/amgkpu1d9ttijyeyw2m4lso3egb4sola https://www.dropbox.com/s/g8kvfl4xtj2vr24/EQGRP-Auction-Files.zip https://ln.sync.com/dl/5bd1916d0#eet5ufvg-tjijei4j-vtadjk6b-imyg2qkd https://yadi.sk/d/QY6smCgTtoNz6 Free Files (Proof) - ------------------ eqgrp-free-file.tar.xz.gpg sha256sum = b5961eee7cb3eca209b92436ed7bdd74e025bf615b90c408829156d128c7a169 gpg --decrypt --output eqgrp-free-file.tar.xz eqgrp-free-file.tar.xz.gpg Password = theequationgroup Auction Files - ------------- eqgrp_auction_file.tar.xz.asc sha256sum = af1dabd8eceec79409742cc9d9a20b9651058bbb8d2ce60a0edcfa568d91dbea Password = ???? Auction Instructions - -------------------- We auction best files to highest bidder. Auction files better than stuxnet. Auction files better than free files we already give you. The party which sends most bitcoins to address: 19BY2XCgbDe6WtTVbTyzM9eR3LYr6VitWK before bidding stops is winner, we tell how to decrypt. Very important!!! When you send bitcoin you add additional output to transaction. You add OP_Return output. In Op_Return output you put your (bidder) contact info. We suggest use bitmessage or I2P-bote email address. No other information will be disclosed by us publicly. Do not believe unsigned messages. We will contact winner with decryption instructions. Winner can do with files as they please, we not release files to public. FAQ - --- Q: Why I want auction files, why send bitcoin? A: If you like free files (proof), you send bitcoin. If you want know your networks hacked, you send bitcoin. If you want hack networks as like equation group, you send bitcoin. If you want reverse, write many words, make big name for self, get many customers, you send bitcoin. If want to know what we take, you send bitcoin. Q: What is in auction files? A: Is secret. Equation Group not know what lost. We want Equation Group to bid so we keep secret. You bid against Equation Group, win and find out or bid pump price up, piss them off, everyone wins. Q: What if bid and no win, get bitcoins back? A: Sorry lose bidding war lose bitcoin and files. Lose Lose. Bid to win! But maybe not total loss. Instead to losers we give consolation prize. If our auction raises 1,000,000 (million) btc total, then we dump more Equation Group files, same quality, unencrypted, for free, to everyone. Q: When does auction end? A: Unknown. When we feel is time to end. Keep bidding until we announce winner. Q: Why I trust you? A: No trust, risk. You like reward, you take risk, maybe win, maybe not, no guarantees. There could be hack, steal, jail, dead, or war tomorrow. You worry more, protect self from other bidders, trolls, and haters. Closing Remarks - -------------------------------------------------- !!! Attention Wealthy Elites !!! We have final message for "Wealthy Elites". We know what is wealthy but what is Elites? Elites is making laws protect self and friends, lie and fuck other peoples. Elites is breaking laws, regular peoples go to jail, life ruin, family ruin, but not Elites. Elites is breaking laws, many peoples know Elites guilty, Elites call top friends at law enforcement and government agencies, offer bribes, make promise future handjobs, (but no blowjobs). Elites top friends announce, no law broken, no crime commit. Reporters (not call journalist) make living say write only nice things about Elites, convince dumb cattle, is just politics, everything is awesome, check out our ads and our prostitutes. Then Elites runs for president. Why run for president when already control country like dictatorship? What this have do with fun Cyber Weapons Auction? We want make sure Wealthy Elite recognizes the danger cyber weapons, this message, our auction, poses to their wealth and control. Let us spell out for Elites. Your wealth and control depends on electronic data. You see what "Equation Group" can do. You see what cryptolockers and stuxnet can do. You see free files we give for free. You see attacks on banks and SWIFT in news. Maybe there is Equation Group version of cryptolocker+stuxnet for banks and financial systems? If Equation Group lose control of cyber weapons, who else lose or find cyber weapons? If electronic data go bye bye where leave Wealthy Elites? Maybe with dumb cattle? "Do you feel in charge?" Wealthy Elites, you send bitcoins, you bid in auction, maybe big advantage for you? bitmessage = BM-NBvAHfp5Y6wBykgbirVLndZtEFCYGht8 i2p-bote = o1uHOkOcMoFEa7O7dbEilzfMvWzo7bDu~td3x9gYz4b4t5OriJ7U6GUWr5GZoWxQ9f2TrIY5RzhpIMVP6hTLXZ END MESSAGE -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJXrr2sAAoJEAQSTyzLXAwbVzwP/jR5sQcS8VzH2jmuRjbE6RLV P3RkY6RWyyTyCtTiyTXK4RtWQoz8CfEjnXdIaR3BIZG4u827iI2fbQMVlWu0jMn4 NYN1I/neBoDaagApRgGQqYXip3IdHsqJennOAxRqr0ZoOgJ3IVtiZK8/6vtEnXRK 03IJvKu0zOVROuP0a9OPX0jko2g3Rl2tvo1ljkU1bqLKHs6xb1VzmdoqlAOYR1Bv 4Kb/Gbr6uc5fG84sM8FzSdiyJgS3U21SqfUENyFLyyP05iCyKCybFMne1JckFre8 gI/nUhdRHJaETYorY49PTQvdBaD30aT1I7efyAAM9uxsF97Au/UEvk0hkzh0YfoR /m+htNKlaP/oclL5GhJEq2O4wWb1KJuyrHU3FZYdUWRA4SlELBb0oR64cw/8kDo+ 6WftSANdlolgQLMbng2/ORGTeXHQ033mX6Op93o2oZUuNNhHvR1PnhWPUA2vMcIs ndo6YuYV2TZR/4GVNiJYQhTcWVNZ7a10FuvWk7yyHkTKXRVHG43G5Rzzm9ZxMUcL DMAExiPnrehGYTcxrrOP28RB+Mw7Is5YwRpc/h0mwDYGijjUzXGLXPWKFLa8ksxR zdaUnAjJzhVwR4IVGmGlU687Ox0FayJz9LAhst5eiittciY0iooz8YLee8hrxD7C XqUIpr4n+QKMYs4AfWd+ =5yni -----END PGP SIGNATURE----- 
 
 RAW Paste Data 
 
 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 From: bitmessage = BM-NBvAHfp5Y6wBykgbirVLndZtEFCYGht8 i2p-bote = o1uHOkOcMoFEa7O7dbEilzfMvWzo7bDu~td3x9gYz4b4t5OriJ7U6GUWr5GZoWxQ9f2TrIY5RzhpIMVP6hTLXZ ﻿Equation Group Cyber Weapons Auction - Invitation - ------------------------------------------------ !!! Attention government sponsors of cyber warfare and those who profit from it !!!! How much you pay for enemies cyber weapons? Not malware you find in networks. Both sides, RAT + LP, full state sponsor tool set? We find cyber weapons made by creators of stuxnet, duqu, flame. Kaspersky calls Equation Group. We follow Equation Group traffic. We find Equation Group source range. We hack Equation Group. We find many many Equation Group cyber weapons. You see pictures. We give you some Equation Group files free, you see. This is good proof no? You enjoy!!! You break many things. You find many intrusions. You write many words. But not all, we are auction the best files. Picture Urls - ------------ http://imgur.com/a/sYpyn https://theshadowbrokers.tumblr.com/ https://github.com/theshadowbrokers/EQGRP-AUCTION File Urls - ---------- magnet:?xt=urn:btih:40a5f1514514fb67943f137f7fde0a7b5e991f76&tr=http://diftracker.i2p/announce.php https://mega.nz/#!zEAU1AQL!oWJ63n-D6lCuCQ4AY0Cv_405hX8kn7MEsa1iLH5UjKU https://app.box.com/s/amgkpu1d9ttijyeyw2m4lso3egb4sola https://www.dropbox.com/s/g8kvfl4xtj2vr24/EQGRP-Auction-Files.zip https://ln.sync.com/dl/5bd1916d0#eet5ufvg-tjijei4j-vtadjk6b-imyg2qkd https://yadi.sk/d/QY6smCgTtoNz6 Free Files (Proof) - ------------------ eqgrp-free-file.tar.xz.gpg sha256sum = b5961eee7cb3eca209b92436ed7bdd74e025bf615b90c408829156d128c7a169 gpg --decrypt --output eqgrp-free-file.tar.xz eqgrp-free-file.tar.xz.gpg Password = theequationgroup Auction Files - ------------- eqgrp_auction_file.tar.xz.asc sha256sum = af1dabd8eceec79409742cc9d9a20b9651058bbb8d2ce60a0edcfa568d91dbea Password = ???? Auction Instructions - -------------------- We auction best files to highest bidder. Auction files better than stuxnet. Auction files better than free files we already give you. The party which sends most bitcoins to address: 19BY2XCgbDe6WtTVbTyzM9eR3LYr6VitWK before bidding stops is winner, we tell how to decrypt. Very important!!! When you send bitcoin you add additional output to transaction. You add OP_Return output. In Op_Return output you put your (bidder) contact info. We suggest use bitmessage or I2P-bote email address. No other information will be disclosed by us publicly. Do not believe unsigned messages. We will contact winner with decryption instructions. Winner can do with files as they please, we not release files to public. FAQ - --- Q: Why I want auction files, why send bitcoin? A: If you like free files (proof), you send bitcoin. If you want know your networks hacked, you send bitcoin. If you want hack networks as like equation group, you send bitcoin. If you want reverse, write many words, make big name for self, get many customers, you send bitcoin. If want to know what we take, you send bitcoin. Q: What is in auction files? A: Is secret. Equation Group not know what lost. We want Equation Group to bid so we keep secret. You bid against Equation Group, win and find out or bid pump price up, piss them off, everyone wins. Q: What if bid and no win, get bitcoins back? A: Sorry lose bidding war lose bitcoin and files. Lose Lose. Bid to win! But maybe not total loss. Instead to losers we give consolation prize. If our auction raises 1,000,000 (million) btc total, then we dump more Equation Group files, same quality, unencrypted, for free, to everyone. Q: When does auction end? A: Unknown. When we feel is time to end. Keep bidding until we announce winner. Q: Why I trust you? A: No trust, risk. You like reward, you take risk, maybe win, maybe not, no guarantees. There could be hack, steal, jail, dead, or war tomorrow. You worry more, protect self from other bidders, trolls, and haters. Closing Remarks - -------------------------------------------------- !!! Attention Wealthy Elites !!! We have final message for "Wealthy Elites". We know what is wealthy but what is Elites? Elites is making laws protect self and friends, lie and fuck other peoples. Elites is breaking laws, regular peoples go to jail, life ruin, family ruin, but not Elites. Elites is breaking laws, many peoples know Elites guilty, Elites call top friends at law enforcement and government agencies, offer bribes, make promise future handjobs, (but no blowjobs). Elites top friends announce, no law broken, no crime commit. Reporters (not call journalist) make living say write only nice things about Elites, convince dumb cattle, is just politics, everything is awesome, check out our ads and our prostitutes. Then Elites runs for president. Why run for president when already control country like dictatorship? What this have do with fun Cyber Weapons Auction? We want make sure Wealthy Elite recognizes the danger cyber weapons, this message, our auction, poses to their wealth and control. Let us spell out for Elites. Your wealth and control depends on electronic data. You see what "Equation Group" can do. You see what cryptolockers and stuxnet can do. You see free files we give for free. You see attacks on banks and SWIFT in news. Maybe there is Equation Group version of cryptolocker+stuxnet for banks and financial systems? If Equation Group lose control of cyber weapons, who else lose or find cyber weapons? If electronic data go bye bye where leave Wealthy Elites? Maybe with dumb cattle? "Do you feel in charge?" Wealthy Elites, you send bitcoins, you bid in auction, maybe big advantage for you? bitmessage = BM-NBvAHfp5Y6wBykgbirVLndZtEFCYGht8 i2p-bote = o1uHOkOcMoFEa7O7dbEilzfMvWzo7bDu~td3x9gYz4b4t5OriJ7U6GUWr5GZoWxQ9f2TrIY5RzhpIMVP6hTLXZ END MESSAGE -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJXrr2sAAoJEAQSTyzLXAwbVzwP/jR5sQcS8VzH2jmuRjbE6RLV P3RkY6RWyyTyCtTiyTXK4RtWQoz8CfEjnXdIaR3BIZG4u827iI2fbQMVlWu0jMn4 NYN1I/neBoDaagApRgGQqYXip3IdHsqJennOAxRqr0ZoOgJ3IVtiZK8/6vtEnXRK 03IJvKu0zOVROuP0a9OPX0jko2g3Rl2tvo1ljkU1bqLKHs6xb1VzmdoqlAOYR1Bv 4Kb/Gbr6uc5fG84sM8FzSdiyJgS3U21SqfUENyFLyyP05iCyKCybFMne1JckFre8 gI/nUhdRHJaETYorY49PTQvdBaD30aT1I7efyAAM9uxsF97Au/UEvk0hkzh0YfoR /m+htNKlaP/oclL5GhJEq2O4wWb1KJuyrHU3FZYdUWRA4SlELBb0oR64cw/8kDo+ 6WftSANdlolgQLMbng2/ORGTeXHQ033mX6Op93o2oZUuNNhHvR1PnhWPUA2vMcIs ndo6YuYV2TZR/4GVNiJYQhTcWVNZ7a10FuvWk7yyHkTKXRVHG43G5Rzzm9ZxMUcL DMAExiPnrehGYTcxrrOP28RB+Mw7Is5YwRpc/h0mwDYGijjUzXGLXPWKFLa8ksxR zdaUnAjJzhVwR4IVGmGlU687Ox0FayJz9LAhst5eiittciY0iooz8YLee8hrxD7C XqUIpr4n+QKMYs4AfWd+ =5yni -----END PGP SIGNATURE----- ||||| A mysterious hacker or hackers going by the name “The Shadow Brokers” claims to have hacked a group linked to the NSA and dumped a bunch of its hacking tools. In a bizarre twist, the hackers are also asking for 1 million bitcoin (around $568 million) in an auction to release more files. 
 
 “Attention government sponsors of cyber warfare and those who profit from it!!!!” the hackers wrote in a manifesto posted on Pastebin, on GitHub, and on a dedicated Tumblr. “How much you pay for enemies cyber weapons? [...] We find cyber weapons made by creators of stuxnet, duqu, flame.” 
 
 The hackers referred to their victims as the Equation Group, a codename for a government hacking group widely believed to be the NSA. 
 
 ”We find cyber weapons made by creators of stuxnet, duqu, flame.” 
 
 The security firm Kaspersky Lab unmasked Equation Group in 2015, billing it as the most advanced hacking group Kaspersky researchers had ever seen. While Kaspersky Lab stopped short of saying it’s the NSA, its researchers laid out extensive evidence pointing to the American spy agency, including a long series of codenames used by the Equation Group and found in top secret NSA documents released by Edward Snowden. The Equation Group, according to Kaspersky Lab, targeted the same victims as the group behind Stuxnet, which is widely believed to have been a joint US-Israeli operation targeting Iran’s nuclear program, and also used two of the same zero-day exploits. 
 
 The Shadow Brokers claimed to have hacked the Equation Group and stolen some of its hacking tools. They publicized the dump on Saturday, tweeting a link to the manifesto to a series of media companies. 
 
 The dumped files mostly contain installation scripts, configurations for command and control servers, and exploits targeted to specific routers and firewalls. The names of some of the tools correspond with names used in Snowden documents, such as “BANANAGLEE” or “EPICBANANA.” 
 
 It’s unclear if the data is legitimate, but some security experts agree that it likely is. 
 
 “If this is a hoax, the perpetrators put a huge amount of effort in,” the security researcher known as The Grugq told Motherboard. “The proof files look pretty legit, and they are exactly the sorts of exploits you would expect a group that targets communications infrastructure to deploy and use.” 
 
 Claudio Guarnieri, an independent security researcher who’s investigated other hacking operations by the Western intelligence agencies, told me that the files might be from a hacked NSA server used in an operation. He also cautioned that this is a preliminary analysis and that more analysis is needed. 
 
 The most recent file is dated June 2013, though the hackers could have tampered with the dates. Dmitri Alperovitch, the co-founder of security firm CrowdStrike, theorized that “the leakers were probably sitting on this information for years, waiting for the most opportune time to release.” 
 
 Matt Tait, another security researcher and former British intelligence officer, tweeted that the data could come from “an old counter-hack.” 
 
 “The proof files look pretty legit, and they are exactly the sorts of exploits you would expect a group that targets communications infrastructure“ 
 
 
 
 A Kaspersky Lab researcher declined to comment. Another Kaspersky Lab researcher noted on Twitter that there is “nothing” in the dumped files that links them to the Equation Group, but some of their names are from the ANT Catalog, an NSA hacking toolset published by Der Spiegel in late 2013. It’s worth noting that while the files dumped by The Shadow Brokers might not have a direct connection with the Equation Group, they could come from a different operation that those seen by Kaspersky Lab. 
 
 The Shadow Broker claimed to have gotten the files by following Equation Group “traffic,” hacking the group and finding its “cyber weapons.” (The hackers did not respond to a request for comment, and neither did the NSA.) 
 
 At the time of writing, the Bitcoin wallet where the hackers accept auction offers has yet to receive any funds. 
 
 The motives behind this strange dump are unclear, but if legitimate, this could be one of the most shocking hacks ever.
– An apparent hacking group calling itself the "Shadow Brokers" claims to have hacked the NSA and is asking for about $570 million to share the data. Two sets of files were posted online Saturday—one open, the other encrypted—which the group claims are from the Equation Group, an advanced group of hackers believed to be working with US intelligence. The open files contain "a series of tools for penetrating network gear made by Cisco, Juniper, and other major firms," along with code words found in documents leaked by Edward Snowden, reports Foreign Policy. They are "most likely … part of the NSA toolset," an expert tells Ars Technica. But the encrypted files are "the best files," says the Shadow Brokers, which is asking for 1 million Bitcoin, currently worth about $570 million, to release them. "We hack Equation Group. We find many many Equation Group cyber weapons," the Shadow Brokers writes in a manifesto. In a message directed to "wealthy elites," the group warns about the danger of cyber weapons, noting "your wealth and control depends on electronic data." The NSA hasn't confirmed any breach, but security researchers say the open files—dating from about 2010 to 2013—look authentic. "It's at minimum very interesting; at maximum, hugely damaging," says a former NSA research scientist. "It'll blow some operations if those haven't already been blown." Another expert tells Motherboard that the files could be from "a hacked NSA server used in an operation." Others suspect Russia is involved, given the reported source of the recent DNC hack.