'Strong Connection' Between Files Leaked By ShadowBrokers & The Equation Group'Strong Connection' Between Files Leaked By ShadowBrokers & The Equation Group
Researchers from Kaspersky Lab, which exposed the so-called Equation Group two years ago, say several hundred of the hacking tools leaked online have ties to the nation-state gang.
August 17, 2016
The team of researchers at Kaspersky Lab who initially exposed the so-called Equation Group in 2015 today confirmed that several hundred of the purported tools leaked online have ties to that sophisticated hacker group.
The researchers found that a rare deployment of RC5/RC6 encryption in the files dumped online this week by the so-called "ShadowBrokers" matches that of the Equation Group. Kaspersky Lab has never confirmed Equation Group is the NSA -- it does not confirm attribution of groups -- but security experts say the two are one in the same.
ShadowBrokers claimed to have in its possession stolen Equation Group tools and files, which it has offered for sale online. Security experts for the past couple of days have been debating the authenticity of the leak, as well as just who may be behind it -- not to mention just how and when the National Security Agency (NSA) could have been breached.
"This code similarity makes us believe with a high degree of confidence that the tools from the ShadowBrokers leak are related to the malware from the Equation Group. While the ShadowBrokers claimed the data was related to the Equation Group, they did not provide any technical evidence of these claims. The highly specific crypto implementation above confirms these allegations," the Kaspersky Lab researchers wrote in a blog post today.
More than 300 of the files dumped by ShadowBrokers use the RC6 crypto implementation associated with the Equation Group. "There are more than 300 files in the Shadowbrokers’ archive which implement this specific variation of RC6 in 24 different forms. The chances of all these being faked or engineered is highly unlikely," the researchers said.
Former NSA analyst Blake Darche, who has been studying the leak, says the tools appear to be legitimate. Darche, CTO and co-founder of Area 1, says the backdoors and exploits in the dump include a tool called SecondDate that runs on Cisco PIX631 firewalls.
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
How to Deploy Zero Trust for Remote Workforce Security
What Ransomware Groups Look for in Enterprise Victims
How to Use Threat Intelligence to Mitigate Third-Party Risk
Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware
Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
The Burnout Breach: How employee burnout is emerging as the next frontier in cybersecurity
Maximize the Human Potential of Your SOC
Gone Phishing: How to Defend Against Persistent Phishing Attempts Targeting Your Organization