Ghost hackers: the cybersecurity mystery that nobody has solved | TechCrunch

Many historic data breaches remain unsolved, with hackers and groups never identified. Some prolific groups have been caught, including cybercriminal groups such as LAPSUS$ and government-linked hacking groups from Russia and China whose members were named and indicted. Despite these cases, some major cybersecurity incidents remain unresolved, with no culprits, no clear answers, and sometimes no clear motive. One notable case involves Shadow Brokers, an enigmatic group that appeared online, released a trove of hacking tools believed to be associated with the NSA, and then disappeared. In 2016, during election-related Russian hacking activity, the group posted on Twitter and linked to a Pastebin document titled “Equation Group Cyber Weapons Auction - Invitation,” claiming to have hacked the Equation Group and offering tools for download and an encrypted auction file.

"But prolific hacking groups do get caught. This is true whether they're cybercriminals such as LAPSUS$, a notorious extortion gang that compromised companies including Microsoft and Nvidia, who have had multiple members arrested, or sophisticated government hacking groups from Russia and China, whose members have been named, indicted, and placed on most-wanted lists."

"The first installment centers on the Shadow Brokers - an enigmatic group that surfaced online, dumped a trove of hacking tools believed to belong to the NSA, and then vanished. In the summer of 2016, in the midst of the Russian hacks related to the U.S. Presidential elections, the group appeared on Twitter. They linked to a Pastebin post and @-mentioned several news outlets - a strange, ineffective strategy that meant most of those outlets likely never saw the tweets."

"But if anyone had clicked on the link, they would have seen a document titled "Equation Group Cyber Weapons Auction - Invitation" - a reference to the shadowy hacking operation widely believed to be run by the NSA. "!!! Attention government sponsors of cyber warfare and those who profit from it !!!! How much you pay for enemies' cyber weapons?" the hackers wrote, claiming to have hacked the Equation Group."

"The document included links to download some hacking tools, as well as a link to download an encrypted file that interested buyers could decrypt by making a bid. "Auction files better than Stuxnet," they wrote,"

Read at TechCrunch