In August 2016, a group calling themselves "The Shadow Brokers" claimed to have stolen offensive cyber tools from the Equation Group - the NSA's elite hacking unit, so named by Kaspersky researchers who documented its capabilities in 2015. The Shadow Brokers published a sample of the stolen tools as proof, auctioned the full set in Bitcoin (receiving essentially nothing), and then over the following months leaked increasingly sensitive material in a series of dramatic public dumps. The leaks culminated in April 2017 with the release of a collection that included EternalBlue, EternalRomance, DoublePulsar, and other NSA exploits targeting Windows systems.
EternalBlue exploited a critical vulnerability in Windows SMBv1 (CVE-2017-0144). Within weeks of its release, it became the most weaponized exploit in history: WannaCry used it to infect 200,000 machines in 150 countries in three days. NotPetya used it to cause $10 billion in damage. It was incorporated into Eternal frameworks used by criminal groups for years afterward. The NSA had known about the SMB vulnerability and kept it secret for at least five years, using it as an offensive tool. Microsoft had not been informed. When the exploit leaked publicly, Microsoft had to release an emergency patch; Windows XP, which Microsoft had stopped supporting in 2014, received a patch for the first time in years because the vulnerability was so severe.
The Equation Group and NSA Offensive Tools
The Equation Group was Kaspersky's name for the threat actor behind some of the most sophisticated malware ever analyzed. The group was linked to the NSA's Tailored Access Operations (TAO) division - its elite hacking unit - based on technical similarities with the NSA tools described in the Snowden documents. Equation Group implants discovered in the wild included EquationDrug, GrayFish, and DoubleFantasy, which demonstrated capabilities including firmware-level persistence (surviving disk wipes by rewriting hard drive controller firmware), air-gapped network bridging, and long-term covert access to targeted systems.
The Shadow Brokers' first leak in August 2016 included a set of firewall exploits targeting Cisco, Juniper, and Fortinet devices - tools for breaking into network infrastructure. Subsequent leaks included Windows exploits, the SWIFT banking system attack tools (used in the Bangladesh Bank heist and other attacks), and the April 2017 "Lost in Translation" dump that contained EternalBlue and the DoublePulsar backdoor implant.
The NSA had notified Microsoft of the SMBv1 vulnerability before the April leak - reportedly tipped off that something was coming - and Microsoft released MS17-010 on March 14, 2017. The EternalBlue leak came April 14. Organizations that hadn't patched in the four weeks between the patch release and the leak were exposed. Given that enterprise patch deployment typically takes weeks to months, a massive number of systems were still vulnerable when WannaCry launched five weeks after the leak.
Who Were the Shadow Brokers?
The identity and affiliation of the Shadow Brokers was never officially confirmed, but US intelligence assessments and independent analysis pointed strongly toward Russian intelligence. The timing and content of the leaks - and subsequent public messages mixing broken English with political commentary about Donald Trump and US intelligence community politics - were interpreted as deliberate, politically motivated disclosures rather than purely financially motivated theft.
The most widely cited theory for how the Shadow Brokers obtained the tools was not a remote hack of NSA infrastructure but rather insider theft or operator error. Specifically, the theory that gained most traction was that an NSA operator had staged the tools on an operational server for use in an operation and had inadvertently left them accessible, allowing Russian intelligence to collect them. A competing theory was that the tools were stolen from a former NSA contractor who had brought them off-network. Harold T. Martin III, an NSA contractor, was arrested in 2016 for hoarding enormous quantities of classified NSA material at his home - he was not accused of being the Shadow Brokers source, but the incident illustrated that classified offensive tools were not exclusively held within NSA's secure infrastructure.
The public release of the tools, rather than use for intelligence purposes, suggested a political motive: demonstrating that the NSA was vulnerable, humiliating the intelligence community, and - by triggering WannaCry and NotPetya as downstream effects - demonstrating the destructive potential of hoarded vulnerabilities. The timing of certain leaks relative to US political events supported the narrative of deliberate information warfare.
The SWIFT Banking Exploits
One underreported element of the Shadow Brokers leaks was the inclusion of tools for attacking SWIFT - the international banking messaging system. The leaked toolkit included "EvilOlive" and other tools for accessing SWIFT Alliance Access systems, which are the software gateways banks use to send and receive SWIFT messages. These tools had been used operationally: the Bangladesh Bank heist in February 2016 (in which $81 million was stolen via fraudulent SWIFT messages) bore similarities to what the leaked tools could achieve. Attribution of the Bangladesh Bank heist went to Lazarus Group (North Korea), raising questions about whether North Korea had independently developed SWIFT attack capabilities or had somehow obtained NSA tools before the public Shadow Brokers release.
The SWIFT-related tools in the leak prompted SWIFT itself to urgently update its security guidance to member banks and accelerate deployment of its Customer Security Program. The revelation that an intelligence agency had developed and used operational tools specifically targeting the international banking messaging infrastructure - and that those tools were now public - was a significant shock to the financial sector's assumptions about critical financial infrastructure security.