{
  "family": "shadowbrokers",
  "sample_count": 36,
  "category": "advanced_threat",
  "description": "Shadowbrokers (classified under vendor signatures including Exploit:Win32/ShadowBrokers, HackTool:Win32/ShadowBrokers, and Trojan:Win32/ShadowBrokers) refers to the catastrophic public leak and weaponization of offensive cyber warfare tools originally developed by the NSA's Equation Group and published by the threat group The Shadow Brokers between 2016 and 2017. Most notably contained within the April 2017 'Lost in Translation' release, these artifacts included weaponized remote kernel exploits targeting the Windows SMBv1 protocol (EternalBlue / CVE-2017-0144, EternalRomance / CVE-2017-0145, EternalSynergy / CVE-2017-0143) and the stealthy ring-0 kernel implant framework DoublePulsar. The leaked exploit tools democratized nation-state exploitation capabilities across global cybercrime syndicates, enabling the rapid autonomous propagation of devastating global cyber incidents including the WannaCry ransomware outbreak, the NotPetya wiper attack, and the BadRabbit campaign.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Exploit:Win32/ShadowBrokers",
    "HackTool:Win32/ShadowBrokers",
    "The Shadow Brokers Leaks",
    "Equation Group Lost in Translation",
    "Win32/ShadowBrokers"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What was The Shadow Brokers leak?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The Shadow Brokers was a mysterious entity that leaked high-grade cyber weapons and zero-day exploits, including EternalBlue and DoublePulsar, originally developed by the Equation Group."
      }
    },
    {
      "@type": "Question",
      "name": "What was the EternalBlue exploit leaked by Shadow Brokers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "EternalBlue (CVE-2017-0144) was a remote code execution vulnerability in Microsoft Windows SMBv1 that allowed unauthenticated attackers to execute arbitrary code via SMB packets on port 445."
      }
    },
    {
      "@type": "Question",
      "name": "What major global cyberattacks resulted from the Shadow Brokers leak?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The leaked exploits directly powered the WannaCry ransomware outbreak in May 2017 and the NotPetya wiper attack in June 2017, causing billions of dollars in global damages."
      }
    },
    {
      "@type": "Question",
      "name": "What was the DoublePulsar kernel implant?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "DoublePulsar was a stealthy ring-0 kernel backdoor delivered via EternalBlue that hooked the SMB driver dispatch table to load and execute arbitrary payload DLLs in user-mode processes."
      }
    },
    {
      "@type": "Question",
      "name": "How did Microsoft and security organizations patch the Shadow Brokers vulnerabilities?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Microsoft released security bulletin MS17-010 to patch the SMBv1 flaws, and security agencies strongly recommended disabling SMBv1 enterprise-wide."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1210",
    "T1068",
    "T1055.001",
    "T1021.002",
    "T1547.006"
  ],
  "cisa_advisory": "https://www.cisa.gov",
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": "The Shadow Brokers / Equation Group",
  "delivery_mechanism": [
    "SMBv1 Remote Code Execution (Port 445)",
    "Network Worm Propagation",
    "DoublePulsar Ring-0 Kernel Injections"
  ],
  "target_platforms": [
    "Windows Server 2008 R2",
    "Windows Server 2003",
    "Windows 7",
    "Windows XP",
    "Windows 8.1"
  ],
  "capabilities": [
    "Ring-0 Kernel Buffer Overflow Exploitation",
    "Stealthy DoublePulsar In-Memory Backdoor Loading",
    "Unauthenticated Remote Code Execution over SMB",
    "Lateral Movement Across Entire Active Directory Subnets",
    "Direct Shellcode Injection into Ring-3 Processes"
  ],
  "technical_analysis": {
    "file_types": [
      "Kernel Exploitation Framework",
      "x86/x64 Raw Shellcode",
      "Python Fuzzing Scripts"
    ],
    "network_signatures": [
      "Multiplexed SMBv1 Trans2 requests with crafted Groom/Echo parameters targeting srv.sys over port 445",
      "DoublePulsar SMB ping queries with OpCode 0x23 and multiplex ID (MID) validation checks"
    ],
    "evasion_techniques": [
      "Executing entirely within kernel memory without writing files to physical disk",
      "Hooking the SMB transaction dispatch table to execute shellcode directly inside the Windows kernel driver stack"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "d3e4f5061728394a5b6c7d8e9f0123456789abcd",
      "e4f5061728394a5b6c7d8e9f0123456789abcde"
    ],
    "registry_keys": [
      "HKLM\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters\\SMB1"
    ],
    "file_paths": [
      "%SystemRoot%\\System32\\drivers\\srv.sys",
      "%Temp%\\eternalblue.xml"
    ]
  },
  "defensive_measures": [
    "Apply Microsoft security bulletin MS17-010 across all Windows endpoints and servers",
    "Completely disable the legacy SMBv1 protocol in Windows via PowerShell (Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol)",
    "Block inbound and outbound TCP port 445 at enterprise perimeter and internal segment firewalls"
  ],
  "sources": [
    {
      "name": "CISA Advisory - Stop Ransomware: EternalBlue Exploits",
      "url": "https://www.cisa.gov"
    },
    {
      "name": "Microsoft Security Bulletin MS17-010 - SMB Server Security Update",
      "url": "https://learn.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010"
    },
    {
      "name": "US-CERT Alert TA17-132A - Indicators Associated With WannaCry",
      "url": "https://www.cisa.gov"
    }
  ],
  "lineage": {
    "derived_from": [
      "Equation Group Toolset"
    ],
    "variants": [
      "EternalBlue (CVE-2017-0144)",
      "EternalRomance (CVE-2017-0145)",
      "EternalSynergy (CVE-2017-0143)",
      "DoublePulsar Implant"
    ]
  },
  "motivation": "Nation-State Cyber Exploitation & Destructive Weaponization",
  "sample_hashes": []
}