Select Page

On August 13, 2016, a hacking unit calling itself “The Shadow Brokers” announced that it had stolen malware tools and exploits used by the Equation Group, a sophisticated threat actor believed to be affiliated to the Tailored Access Operations (TAO) unit of the U.S. National Security Agency (NSA).

Although the group has since signed off following the unprecedented disclosures, new “conclusive” evidence unearthed by Check Point Research shows that this was not an isolated incident, and those other threat actors may have had access to some of the same tools before they were published.

The previously undocumented cyber-theft took place more than two years prior to the Shadow Brokers episode, the American-Israeli cybersecurity company said in an exhaustive report published today, resulting in U.S.-developed cyber tools reaching the hands of a Chinese advanced persistent threat which then repurposed them in order to strike American targets.

“The caught-in-the-wild exploit of CVE-2017-0005, a zero-day attributed by Microsoft to the Chinese APT31 (aka Zirconium), is in fact a replica of an Equation Group exploit codenamed ‘EpMe,'” Check Point researchers Eyal Itkin and Itay Cohen said. “APT31 had access to EpMe’s files, both their 32-bits and 64-bits versions, more than two years before the Shadow Brokers leak.”

The Equation Group, so-called by researchers from cybersecurity firm Kaspersky in February 2015, has been linked to a string of attacks affecting “tens of thousands of victims” as early as 2001, with some of the registered command-and-control servers dating back to 1996. Kaspersky called the group the “crown creator of cyberespionage.”

images from Hacker News