Adam Caudill

Security Leader, Researcher, Developer, Writer, & Photographer

Shadow Brokers, Equation Group, Oh My…

NSA / Equation Group

Yet again, a group known as The Shadow Brokers is in the news, with yet another leak from what is widely accepted as the NSA (Equation Group1 in APT terms). This release is, to many, the most important release of this leaked stolen material from the most elite and secretive hacking operation in the world.

This is a collection of a few notes on this highly unusual operation. If you haven’t read this excellent overview of the most recent release by Dan Goodin, you should do that now.

A Brief Timeline #

The Shadow Brokers have released material on five occasions2:

A group of files were uploaded to Github (and quickly removed), including a file (“eqgrp-auction-file.tar.xz.gpg”) containing exploits and implants for Linux and similar operating systems, and a file (“eqgrp-free-file.tar.xz.gpg” with a password of theequationgroup) containing exploits and implants for a variety of networking equipment; the latter used as a sample.

A second, smaller sample file named “trickortreat.tar.xz.gpg” with a password of payus.

In what was purported at the time to be their final message, Shadow Brokers released a new file, “equation_drug.tar.xz.gpg” that included files that had been identified by Kaspersky AntiVirus as being Trojan.Win32.EquationDrug.

In a only somewhat surprising move, they posted a rambling treatise on US politics and Donald Trump, which included the password (CrDj"(;Va.*NdlnzB9M?@K2)#>deB7mN) for “eqgrp-auction-file.tar.xz.gpg” – the file they tried and failed to sell when they started. This contain the Linux exploits and implants that had been promised, though much of the content was rather old and of little interest.

Perhaps the most exciting release, as it included the Windows exploits and the Equation Group’s equivalent of Metasploit called FuzzBunch – but the story doesn’t end there, there was a big surprise included. The three files are “windows.tar.xz.gpg”, “odd.tar.xz.gpg”, and “swift.tar.xz.gpg” – with the last containing an unexpected surprise.

Burning Gold #

As the community works to analyze the latest dump, going through the exploits trying to identify what they are, and if they are known some very interesting things have been found. ETERNALBLUE appears to be an 0day against Windows XP, Vista, 2003, 2008, 2008R2, and Windows 7 (it’s being reported that Windows 10 is vulnerable as well3) – one can imagine that there is panic in Redmond as Microsoft works to analyze it and prepare a patch. This is just one exploit, there’s also ETERNALCHAMPION, EASYBEE, EASYPI, ECLIPSEDWING, EDUCATEDSCHOLAR, EMERALDTHREAD, EMPHASISMINE, ENGLISHMANSDENTIST, ERRATICGOPHER, ESKIMOROLL, ESTEEMAUDIT, ETERNALROMANCE, ETERNALSYNERGY, EWOKFRENZY, EXPLODINGCAN, and ZIPPYBEER – there’s a lot of work to be done to fully understand the impact and figure out what needs to be fixed. A number of versions of Windows targeted by these exploits are not supported, such as Windows XP, Windows 2003, and Vista – meaning that there’s no patch coming, these systems will remain vulnerable forever.

What’s clear here is, there is some real value in the exploits that have been released (estimated at $2M or more) – and are likely very important to NSA intelligence operations (or at least they would have been till they learned that they had been compromised).

As NSA doesn’t talk about anything if it can be avoided, it’s unlikely that we will ever know what the impact is to their operations. We will likely see just how effective these exploits are though, as criminals work to leverage these exploits in exploit-kits and the like – you can be sure, just because these exploits are known, this certainly isn’t the last we’ll see of them.

The SWIFT Files #

While it was known that they had various Windows exploits, they dropped something that is of less interest from a technical perspective, though fascinating from an operational perspective: there’s a collection of operator’s notes relating to attacks on SWIFT. These files include detailed system configurations, passwords, and step by step notes of what was done on the devices that were attacked.

Matt Suiche has done a great job of documenting what’s exposed by this cache, so I won’t repeat that here. If you want a better understanding of how they work, and what they’ve done, I highly suggest reading it.

The Origin #

There’s been a great deal of debate about the source of these files, some have suggested that it was an insider, possibly even Harold Thomas Martin, though an insider makes little sense. The data is most likely from a jump-server – a server that NSA operators would push their files to, and connect to targets from. This would explain the type of files and documentation found – and would explain the files that aren’t included, such as source code, training material, and similar files that an insider would have access to, but wouldn’t be stored on a server outside of their network.

One likely scenarios is that a jump-server was captured by another intelligence agency, and the leaks and bizarre rants were part of a political play – though their choices of how to release information has greatly reduced their effectiveness. The SWIFT files could have been positioned as a WikiLeaks-styled bombshell, though was dropped quietly without the fanfare to make news outside of the normal technology publications – while the exploits have a substantial impact, they are of little interest to most people outside of the industry, the SWIFT work on the other hand, could be of much larger significance.

The level of detail about targets, and details from operator logs should allow the NSA to narrow the possible sources; I’m hoping that at some point there’s an official statement about who they believe is releasing these files – though the odds of that happening don’t seem good.


  1. The name Equation Group was coined by Kaspersky, while they didn’t directly state that Equation Group is the NSA (or possibly, just NSA’s TAO group), a close look at the evidence is quite clear. The material released fits with both the signatures of the Equation Group and with a US Government operation. There is some small chance that the attribution is wrong, but the odds of that appear to be quite low. ↩︎

  2. From the start of these releases, I’ve maintained an archive of the files, so that they are searchable and browsable. This has made it easy to review the files, and quickly find related files. It’s interesting to say the least. ↩︎

  3. Update 2017-04-15: Microsoft has released an update on their review of these exploits; ETERNALBLUE, ETERNALROMANCE, and ETERNALSYNERGY were all addressed in MS17-010 released in March 2017 (the source of the report was not listed). They confirmed the issue impacted Windows 10, and pretty much every other supported version of Windows. ↩︎

Adam Caudill


Related Posts

  • Dezinformatsiya

    I recently wrote a review on Active Measures by Thomas Rid – which helped me to solidify my thoughts on social media, and the impact it has on society. While Active Measures is focused on disinformation campaigns, it also speaks to the vulnerabilities in humans that allow these campaigns to work. Disinformation is a substantial issue today, and not just in terms of election interference, public health, or international relations – but also in much smaller scale unorganized efforts to alter perception.

  • Book Review: Active Measures

    Thomas Rid has delivered with Active Measures, it’s clear, surprisingly entertaining, and extremely well sourced. This is a must-read if you want to understand how disinformation operations work, and more importantly, how we managed to find ourselves in a world where it’s hard to trust anything. The book starts with the birth of modern disinformation in the 1920s, following the advances, successes and failures, though to the fiasco that was the 2016 elections.

  • Exploiting the Jackson RCE: CVE-2017-7525

    Earlier this year, a vulnerability was discovered in the Jackson data-binding library, a library for Java that allows developers to easily serialize Java objects to JSON and vice versa, that allowed an attacker to exploit deserialization to achieve Remote Code Execution on the server. This vulnerability didn’t seem to get much attention, and even less documentation. Given that this is an easily exploited Remote Code Execution vulnerability with little documentation, I’m sharing my notes on it.

  • Breaking the NemucodAES Ransomware

    The Nemucod ransomware has been around, in various incarnations, for some time. Recently a new variant started spreading via email claiming to be from UPS. This new version changed how files are encrypted, clearly in an attempt to fix its prior issue of being able to decrypt files without paying the ransom, and as this is a new version, no decryptor was available1. My friends at Savage Security contacted me to help save the data of one of their clients; I immediately began studying the cryptography related portions of the software, while the Savage Security team was busy looking at other portions.

  • Confide, Screenshots, and Imaginary Threats

    Recently Vice published a story about a lawsuit against the makers of the ‘secure’ messaging application Confide. This isn’t just a lawsuit, it’s a class-action lawsuit and brought by Edelson PC – an amazingly successful (and sometimes hated1) law firm – this isn’t a simple case. The complaint includes a very important point: Specifically, Confide fails to deliver on two of the three requirements that it espouses as necessary for confidential communications: ephemerality and screenshot protection.