The Shadow Brokers — Hacktivist Profile
The Shadow Brokers (TSB) is a hacker group who first appeared in the summer of 2016. They published several leaks containing hacking tools from the National Security Agency (NSA), including several zero-day exploits. Specifically, these exploits and vulnerabilities targeted enterprise firewalls, antivirus software, and Microsoft products. The Shadow Brokers originally attributed the leaks to the Equation Group threat actor, who have been tied to the NSA's Tailored Access Operations unit.Also tracked as
@shadowbrokerss, ShadowBrokers, TSB
IntelFusions coverage (2)
- The Story of Jian: How APT31 Stole and Repurposed an NSA Zero-Day Two Years Before the Shadow Brokers Leak 2026-02-16 · Nation-State
- The Shadow Brokers NSA Equation Group Leak: EternalBlue, EternalRomance, DoublePulsar, and the Fuzzbunch Framework Released April 2017 2026-02-16 · Nation-State
Tools & malware
- ArchiTouch leaked NSA/Equation Group reconnaissance tool
- DanderSpritz leaked NSA/Equation Group post-exploitation framework
- DoublePulsar leaked NSA/Equation Group SMB kernel implant
- EsteemAudit leaked NSA/Equation Group exploit
- EternalBlue leaked NSA/Equation Group SMB RCE exploit
- EternalChampion leaked NSA/Equation Group SMB exploit
- EternalRomance leaked NSA/Equation Group SMB exploit
- EternalSynergy leaked NSA/Equation Group SMB exploit
- ExplodingCan leaked NSA/Equation Group exploit
- Fuzzbunch leaked NSA/Equation Group exploitation framework
- KillSuit leaked NSA/Equation Group post-exploitation implant
- PeddleCheap leaked NSA/Equation Group post-exploitation implant
- SECONDDATE leaked NSA/Equation Group MITM redirection tool
- SMBTouch leaked NSA/Equation Group SMB reconnaissance tool
- Tildeb leaked NSA/Equation Group implant targeting Windows NT and Exchange Server
Vendor research
- BROKERS IN THE SHADOWS: Analyzing vulnerabilities and attacks spawned by the leaked NSA hacking tools Check Point Research
- Tildeb: An Implant from the Shadow Brokers Leak Trend Micro
- The NSA Leak Is Real, Snowden Documents Confirm The Intercept
- The Shadow Brokers Leaked Exploits Explained Rapid7
- The Shadow Brokers Announce Details About Upcoming Monthly Dump Service BleepingComputer
- ShadowBrokers' Leak Has 'Strong Connection' to Equation Group Threatpost
- Chinese and Russian Cyber Communities Dig Into Malware From April Shadow Brokers Release Recorded Future