List of Equation Group Files Leaked by Shadow Brokers

More than a week has passed since The Shadow Brokers dumped their files online, claiming to have taken them from the Equation Group, a cyber-espionage group that many experts believe to be the NSA.

The Shadow Brokers say they dumped 60 percent of all the stolen files, and started an auction, promising to give the winner access to the other 40 percent.

Since their initial dump, security researchers from Kaspersky have confirmed the leaked data is similar to what they have seen from past Equation Group malware, and The Intercept, with the help of never-before-seen Snowden documents, has tied the leaked malware with actual NSA cyber-weapons.

Most of the URLs where The Shadow Brokers dumped details about their operation (GitHub, Tumblr, PasteBin) have been taken down, and another PasteBin URL that included a list of all the dumped files was also brought down. We've embedded that original list at the end of this story.

This article is not news per-se, but only provides a list of the files dumped in The Shadow Group leak, along with an explanation of their capabilities, where available.

For sources, we used different analysis provided by Risk Based Security, Mustafa Al-Bassam, Matt Suiche, RST Forums, and other researchers that shared their findings on various exploits on Twitter and GitHub.

For the table below, we used Al-Bassam's categories. A tool is a software package that can deploy multple implants and exploits. An implant is malware that is installed on a compromised device. An exploit is a vulnerability that allows the attacker to compromise the device, extract data, or deploy an implant/tool.