In April 2017, an attack group calling itself the TheShadowBrokers, released a trove of data it claims to have stolen from the Equation cyberespionage group. The data contains a range of exploits and tools the attack group state were used by Equation. TheShadowBrokers said that the data dump was a sample of what had been stolen from hacking Equation and that the “best” files would be auctioned off to the highest bidder.
The Equation group has been known for some time and uses highly advanced malware tools to target organizations in a range of countries. The group is technically competent and well resourced, using highly developed malware tools that go to great lengths to evade detection. Shadows Brokers has released this data in a series of dumps. Symantec Security response often has coverage for these vulnerbilties and tools well in advance of disclosure, but in an effort to make the coverage more readable these are renamed to represent the events they are assoiciated with.
On April 14, 2017 TheShadowBrokers released a collection of files, containing exploits and hacking tools targeting Microsoft Windows. Later that week Microsoft published a blog stating that most of the exploits that were disclosed in this dump fall into vulnerabilities that are already patched in their supported products and then deployed additional patches for some of their older OS'es in their June Security updates. You can see our coverage for the toolset, as well as the older vulns below. For a full list of our coverage for Microsoft Vulns, please see: Symantec product detections for Microsoft monthly Security Bulletins
On April 8th a missive from the TheShadowBrokers also contained another large batch of files. These are mostly characterised as tools and scripts as opposed to the vulnerbilties as seen in the Lost in translation dump. Additionally items like scripts are easily customizable and altered to impact different targets and to avoid static detection.
All coverage information is based on available virus definitions from June 20, 2017
Please note that this is a work in progress and new reseach can be updated regularly.
Changelog:
June 21: Updated "Dont Forget your base" coverage infromation
June 22: Updated ENTERNALSYNERGY CVE information - Thanks to Jerry Bryant for for pointing out the typo
June 29: Updated with additional Equation tool sets