Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/12/2017
03:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Shadow Brokers Calls It Quits After Failing To Get Buyers For NSA Exploits

But group says it is still willing to dump its collection of Linux and Windows tools if it gets 10,000 bitcoins.

Just days after offering for sale a database of Windows exploits allegedly purloined from an outfit thought to be affiliated with the National Security Agency (NSA), the infamous ShadowBrokers hacking crew has apparently decided to call it quits.

As a parting gift, they released an archive of nearly five-dozen Windows hacking tools for free Thursday in an apparent last ditch effort to convince potential buyers of the authenticity of their goods.

They also promised to come out of hiding and still release a collection of Linux and Windows exploits in their possession to anyone willing to pay the equivalent of slightly more than $8 million (10,000 bitcoins at current rates) for it.

In a parting note on the group’s website, the Shadow Brokers claimed the decision to go dark had to do entirely with money, or rather the fact they hadn’t made as much of it as expected from their hacking wares.

The language in the note appeared almost deliberately contrived to make it seem as if members of the group are non-native English speakers. “Despite theories, it always being about bitcoins for TheShadowBrokers,” the note claimed. “Free dumps and bullshit political talk was being for marketing attention.”

The farewell note expressed the group’s disappointment with their lack of success in finding buyers for attack tools they had tried to auction off last year and admonished people for not believing in the Shadow Brokers.

“TheShadowBrokers is going dark, making exit,” because continuing poses too much risk. “TheShadowBrokers is deleting accounts and moving on so don’t be trying communications.”

The Shadow Brokers burst into the limelight last August when it leaked information on multiple attacks tools and exploits that it claimed were stolen from The Equation Group, an outfit, which many believe is affiliated with the NSA. Some believe the group obtained the data from a rogue insider.

In releasing the data, the Shadow Brokers claimed they had an even bigger and better collection of similar attack tools that the NSA had allegedly used over the years for breaking into and intercepting data on adversary systems. They put the tools on auction for tens of millions of dollars last summer and then canceled the auction a few months later after failing to get any interest.

Since then the Shadow Brokers, who many believe have Russian connections, have attempted to sell their goods piecemeal in the cyber underground.  In November the group released data pertaining to a tool allegedly used by the Equation Group for breaking into Sun Solaris systems in addition to list of IP addresses and domains associated with servers used to stage and distribute exploits. Earlier this week, they leaked more information, this time on a slew of exploits and toolkits for breaking into Windows system, which they said they would sell to anyone willing to pay 750 bitcoins.

The data releases, like the first one in August appeared designed to convince people that the data the Shadow Brokers has in its possession is authentic.

Andra Zaharia security evangelist with Heimdal Security, which Thursday updated an earlier alert on the Windows exploit release with news of the Shadow Brokers’ quitting, offers two potential reasons for the move.

“One theory is that The Shadow Brokers were a cover up for another operation, and another could be that, in spite of past poor results in sales, [the latest] offer could have helped them reach their goal in terms of bitcoin revenue,” she says.

For the moment the company is unable to confirm what the true motive might be, she adds. The 58 Windows hacking tools released for free by the Shadow Brokers as a parting gift are all detectable by Kaspersky anti virus, she said.

 “We have not yet tested all the tools, but we would be surprised if more tools didn't detect the tools as malicious,” Zaharia says.

For the moment at least, Hemidal has not been able to confirm if the hacking tools that were released publically this week was the same as the ones put up on sale by the group, she adds.

Related Content:

 

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Row3n
50%
50%
Row3n,
User Rank: Strategist
1/16/2017 | 12:19:52 AM
HI
I hope that this means that people aren't as vicious as we originally though. Although I would assume that some people looking to strike it rich might be keen to explore the potential behind the products to exploit the finance industry. So many implications though! Wouldn't the company be obligated to report who they sell this stuff too since it's so widely known what the programs are used for?
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7981
PUBLISHED: 2020-01-25
sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data.
CVE-2019-0141
PUBLISHED: 2020-01-25
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2020-7596
PUBLISHED: 2020-01-25
Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument.
CVE-2020-7980
PUBLISHED: 2020-01-25
Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed.
CVE-2012-6613
PUBLISHED: 2020-01-25
D-Link DSR-250N devices with firmware 1.05B73_WW allow Persistent Root Access because of the admin password for the admin account.