The hacker group calling itself “Shadow Brokers” has made public another batch of files allegedly obtained from the NSA-linked threat actor tracked as the Equation Group. Microsoft has assured customers that these new exploits don’t affect up-to-date systems.
The Shadow Brokers recently published a password to a previously leaked file and many believed it would represent the group’s last dump. However, the hackers released another round of files on Friday, including exploits for Windows and IBM’s Lotus Domino platform. The leaked files also appear to show that the Equation Group breached the SWIFT banking network and monitored a number of Middle Eastern banks.
Microsoft has analyzed the latest dump and identified a dozen exploits targeting its Windows operating system. According to the company, some of the vulnerabilities leveraged by these exploits were patched back in 2008, 2009, 2010 and 2014.
Four of the exploits, dubbed EternalBlue, EternalChampion, EternalRomance and EternalSynergy, were addressed by Microsoft with the March 2017 security updates — a majority with the MS17-010 patch. The tech giant also pointed out that the remaining exploits do not work on Windows 7 and later, or Exchange 2010 and later.
Microsoft has not shared any information on how it learned about the vulnerabilities. However, experts believe the NSA itself may have disclosed the flaws to the company.
The Shadow Brokers published the names of the exploits leaked on Friday back in January, when they announced an auction for Windows tools. After seeing the list published in January, the NSA may have decided to alert Microsoft knowing that the exploits would likely be made public at some point.
Microsoft doesn’t credit anyone for the report behind the March patch. Was it @NSAGov? If so, it was the right call. Better late than never. https://t.co/aq24jw8fcV
— Edward Snowden (@Snowden) April 15, 2017
It’s also worth noting that Microsoft postponed its February 2017 security updates due to an unspecified “last minute issue,” and the March patches contained fixes for several of the Equation Group exploits.
While there has been a lot of speculation as to who might be behind the Shadow Brokers — some say Russia, while others believe it could be an NSA contractor — the hackers continue to claim that their main goal is to make money. They’ve had several sales strategies, including auctions and crowdfunding, but the Bitcoin address they have provided received only 10 bitcoins.
In a brief statement they published on Friday, the hackers suggested that more files could be released this week.
