Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/12/2017
03:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Shadow Brokers Calls It Quits After Failing To Get Buyers For NSA Exploits

But group says it is still willing to dump its collection of Linux and Windows tools if it gets 10,000 bitcoins.

Just days after offering for sale a database of Windows exploits allegedly purloined from an outfit thought to be affiliated with the National Security Agency (NSA), the infamous ShadowBrokers hacking crew has apparently decided to call it quits.

As a parting gift, they released an archive of nearly five-dozen Windows hacking tools for free Thursday in an apparent last ditch effort to convince potential buyers of the authenticity of their goods.

They also promised to come out of hiding and still release a collection of Linux and Windows exploits in their possession to anyone willing to pay the equivalent of slightly more than $8 million (10,000 bitcoins at current rates) for it.

In a parting note on the group’s website, the Shadow Brokers claimed the decision to go dark had to do entirely with money, or rather the fact they hadn’t made as much of it as expected from their hacking wares.

The language in the note appeared almost deliberately contrived to make it seem as if members of the group are non-native English speakers. “Despite theories, it always being about bitcoins for TheShadowBrokers,” the note claimed. “Free dumps and bullshit political talk was being for marketing attention.”

The farewell note expressed the group’s disappointment with their lack of success in finding buyers for attack tools they had tried to auction off last year and admonished people for not believing in the Shadow Brokers.

“TheShadowBrokers is going dark, making exit,” because continuing poses too much risk. “TheShadowBrokers is deleting accounts and moving on so don’t be trying communications.”

The Shadow Brokers burst into the limelight last August when it leaked information on multiple attacks tools and exploits that it claimed were stolen from The Equation Group, an outfit, which many believe is affiliated with the NSA. Some believe the group obtained the data from a rogue insider.

In releasing the data, the Shadow Brokers claimed they had an even bigger and better collection of similar attack tools that the NSA had allegedly used over the years for breaking into and intercepting data on adversary systems. They put the tools on auction for tens of millions of dollars last summer and then canceled the auction a few months later after failing to get any interest.

Since then the Shadow Brokers, who many believe have Russian connections, have attempted to sell their goods piecemeal in the cyber underground.  In November the group released data pertaining to a tool allegedly used by the Equation Group for breaking into Sun Solaris systems in addition to list of IP addresses and domains associated with servers used to stage and distribute exploits. Earlier this week, they leaked more information, this time on a slew of exploits and toolkits for breaking into Windows system, which they said they would sell to anyone willing to pay 750 bitcoins.

The data releases, like the first one in August appeared designed to convince people that the data the Shadow Brokers has in its possession is authentic.

Andra Zaharia security evangelist with Heimdal Security, which Thursday updated an earlier alert on the Windows exploit release with news of the Shadow Brokers’ quitting, offers two potential reasons for the move.

“One theory is that The Shadow Brokers were a cover up for another operation, and another could be that, in spite of past poor results in sales, [the latest] offer could have helped them reach their goal in terms of bitcoin revenue,” she says.

For the moment the company is unable to confirm what the true motive might be, she adds. The 58 Windows hacking tools released for free by the Shadow Brokers as a parting gift are all detectable by Kaspersky anti virus, she said.

 “We have not yet tested all the tools, but we would be surprised if more tools didn't detect the tools as malicious,” Zaharia says.

For the moment at least, Hemidal has not been able to confirm if the hacking tools that were released publically this week was the same as the ones put up on sale by the group, she adds.

Related Content:

 

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Row3n
50%
50%
Row3n,
User Rank: Strategist
1/16/2017 | 12:19:52 AM
HI
I hope that this means that people aren't as vicious as we originally though. Although I would assume that some people looking to strike it rich might be keen to explore the potential behind the products to exploit the finance industry. So many implications though! Wouldn't the company be obligated to report who they sell this stuff too since it's so widely known what the programs are used for?
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
NetCAT Vulnerability Is Out of the Bag
Dark Reading Staff 9/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16395
PUBLISHED: 2019-09-17
GnuCOBOL 2.2 has a stack-based buffer overflow in the cb_name() function in cobc/tree.c via crafted COBOL source code.
CVE-2019-16396
PUBLISHED: 2019-09-17
GnuCOBOL 2.2 has a use-after-free in the end_scope_of_program_name() function in cobc/parser.y via crafted COBOL source code.
CVE-2019-16199
PUBLISHED: 2019-09-17
eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via an HTTP POST request to certain URLs related to the ReGa core process.
CVE-2019-16391
PUBLISHED: 2019-09-17
SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiser_action.php.
CVE-2019-16392
PUBLISHED: 2019-09-17
SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.