{
  "family": "shadowbrokers",
  "sample_count": 36,
  "category": "ransomware",
  "description": "ThreatActor:ShadowBrokers represents one of the most consequential events in modern cybersecurity history. The Shadow Brokers (TSB) are a hacker group (widely suspected to be Russian state-sponsored, though never definitively attributed) who, beginning in August 2016, leaked gigabytes of highly classified cyber-weapons, exploits, and operational tools stolen from the 'Equation Group'—a threat actor universally believed to be the US National Security Agency (NSA) Tailored Access Operations (TAO) unit.<br><br><b>The Impact of the Shadow Brokers Leak</b><br>To the cybersecurity industry, the Shadow Brokers leak fundamentally altered the threat landscape. The group did not just leak source code; they leaked operational, weaponized binaries and the 'FuzzBunch' exploitation framework. The most critical release occurred in April 2017 ('Lost in Translation'), which contained **EternalBlue** (a zero-day exploit for Windows SMBv1).<br><br><b>Exploitation and the Ransomware Epoch</b><br>Within weeks of the Shadow Brokers releasing EternalBlue (`T1210`), it was reverse-engineered and weaponized by cybercriminals globally. The immediate result was the May 2017 **WannaCry** ransomware worm, which utilized EternalBlue to spread autonomously across unpatched global networks, causing billions of dollars in damage. A month later, the Russian military intelligence (GRU) utilized EternalBlue in the **NotPetya** wiper attack against Ukraine, leading to the most destructive cyberattack in history. The leak also contained the **DoublePulsar** backdoor (`T1505.003`), which was planted on millions of endpoints, allowing attackers stealthy, persistent ring-0 access to compromised machines.<br><br><b>Indicators of Compromise & Global Response</b><br>The impact was an unprecedented global crisis. Microsoft was forced to issue emergency out-of-band patches (MS17-010) for unsupported operating systems like Windows XP. EDR platforms and network IDS/IPS systems were frantically updated to detect EternalBlue SMB exploitation attempts. The legacy of the Shadow Brokers leak is still felt today; variations of the leaked exploits are heavily integrated into penetration testing frameworks (like Metasploit) and continue to be utilized by APTs and ransomware affiliates against unpatched infrastructure.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1190",
    "T1505.003",
    "T1210",
    "T1059.003",
    "T1021.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1210",
      "name": "Exploitation of Remote Services",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1505.003",
      "name": "Server Software Component: Web Shell",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1021.002",
      "name": "Remote Services: SMB/Windows Admin Shares",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Ensure that Microsoft security bulletin MS17-010 is applied universally across the enterprise to mitigate the core EternalBlue SMB vulnerability.",
    "Completely disable the legacy SMBv1 protocol on all Windows machines and network appliances; it is inherently insecure.",
    "Deploy YARA rules and network IDS signatures to detect the presence of the DoublePulsar backdoor ping commands on the network.",
    "Enforce strict network segmentation to limit the lateral movement capabilities of worms utilizing leaked Equation Group exploits."
  ],
  "what_to_avoid": [
    "Do not assume a network is safe just because edge firewalls are patched; internal endpoints must be patched to prevent internal lateral spread (worms).",
    "Avoid running unsupported operating systems (like Windows 7 or Server 2008) in production without isolated VLANs and strict access controls."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}