news.mlab.sh
Threat intelligence
Threat actor

Shadow Brokers

Profile from actors.mlab.sh, coverage from our own index.

Suspected origin
USA
First seen
2016-01-01 00:00:00
Motivation
Financial gain
TLP
WHITE

Breached a server where zero-days accumulated by Equation Group were held, leaked a large section on the internet and tried to sell the rest afterward. Most of the published vulnerabilities have since been fixed by the respective vendors, but many have been used by other threat actors. Most notably among the dumps were zero-days such as ETERNALBLUE that were used for the creation of infamous ransomware explosions such as WannaCry and NotPetya. Shadow Brokers turned out to be an ex-NSA contractor.

Coverage 1