The Shadow Brokers — Hacktivist Profile
The Shadow Brokers is the persona behind a run of 2016-2017 dumps of offensive tooling taken from the Equation Group, the operation Kaspersky documented in 2015 and which reporting has long linked to the NSA's Tailored Access Operations arm. The account first posted on 13 August 2016, offering a cache of exploits in an auction that attracted almost no bidders, and the material released over the following months hit enterprise firewalls, antivirus engines and Microsoft software, some of it unpatched at the time of publication. The consequential release came on 14 April 2017: the batch labeled Lost in Translation carried the ETERNALBLUE SMBv1 exploit, the DOUBLEPULSAR implant and the FUZZBUNCH and DANDERSPRITZ frameworks. Microsoft had shipped MS17-010 a month earlier, on 14 March 2017, a sequence that fuelled speculation the agency had warned the vendor in advance; unpatched estates were overrun regardless once WannaCry in May 2017 and NotPetya that June were both built on ETERNALBLUE. Responsibility for the leaks themselves remains unsettled, with theories running from an agency insider to a Russian intelligence operation, and nobody has been charged over the dumps, although NSA contractor Harold T. Martin III, examined during the investigation, pleaded guilty in 2019 to retaining classified material.Also tracked as
@shadowbrokerss, ShadowBrokers, TSB
IntelFusions coverage (2)
- The Story of Jian: How APT31 Stole and Repurposed an NSA Zero-Day Two Years Before the Shadow Brokers Leak 2026-02-16 · Nation-State
- The Shadow Brokers NSA Equation Group Leak: EternalBlue, EternalRomance, DoublePulsar, and the Fuzzbunch Framework Released April 2017 2026-02-16 · Nation-State
Tools & malware
- ArchiTouch leaked NSA/Equation Group reconnaissance tool
- DanderSpritz leaked NSA/Equation Group post-exploitation framework
- DoublePulsar leaked NSA/Equation Group SMB kernel implant
- EsteemAudit leaked NSA/Equation Group exploit
- EternalBlue leaked NSA/Equation Group SMB RCE exploit
- EternalChampion leaked NSA/Equation Group SMB exploit
- EternalRomance leaked NSA/Equation Group SMB exploit
- EternalSynergy leaked NSA/Equation Group SMB exploit
- ExplodingCan leaked NSA/Equation Group exploit
- Fuzzbunch leaked NSA/Equation Group exploitation framework
- KillSuit leaked NSA/Equation Group post-exploitation implant
- PeddleCheap leaked NSA/Equation Group post-exploitation implant
- SECONDDATE leaked NSA/Equation Group MITM redirection tool
- SMBTouch leaked NSA/Equation Group SMB reconnaissance tool
- Tildeb leaked NSA/Equation Group implant targeting Windows NT and Exchange Server
Vendor research
- BROKERS IN THE SHADOWS: Analyzing vulnerabilities and attacks spawned by the leaked NSA hacking tools Check Point Research
- Tildeb: An Implant from the Shadow Brokers Leak Trend Micro
- The NSA Leak Is Real, Snowden Documents Confirm The Intercept
- The Shadow Brokers Leaked Exploits Explained Rapid7
- The Shadow Brokers Announce Details About Upcoming Monthly Dump Service BleepingComputer
- ShadowBrokers' Leak Has 'Strong Connection' to Equation Group Threatpost
- Chinese and Russian Cyber Communities Dig Into Malware From April Shadow Brokers Release Recorded Future