UNITEDRAKE (the tool for control of Windows)

2017: Emergence in a public access

In September, 2017 the Shadow Brokers grouping decided to remind of itself again, having published, to be exact, having offered for sale, one more archive of hacker tools of the NSA. While the most part of this archive is secret, Brokers as demonstration laid out one of these tools in free access. The modular UNITEDRAKE platform used for installation of full control over the Windows systems was it.^[1]

Existence of UNITEDRAKE became known in 2014 when the The Intercept edition began to publish the data "merged" by Edward Snowden. UNITEDRAKE then called "implant" which using a set of plug-ins can be used for total capture of the computer.

Shadow Brokers try to earn from cyberespionage tools of the NSA again

The same tool, but under other name (EquationDrug), was mentioned in the "historical" publication of Kaspersky Lab in February, 2015 in which the name Equation Group for the first time was heard. So experts called the grouping performing active and large-scale cyberespionage operations since the end of the 1990th or began the 2000th.^[2]

EquationDrug was called one of the most difficult cyberespionage platforms of an arsenal of the Equation Group grouping. Afterwards it was connected with the U.S. National Security Agency. For this reason "flowed away" and somehow the tools which were at the disposal of Shadow Brokers are called both "exploits of the NSA", and "Equation exploits".

The publication UNITEDRAKE as some experts believe, can lead to declassification of a number of large transactions of the American intelligence agencies though it is considered that this platform went out of use in 2014.

What is in other archives for which Shadow Brokers want to receive money, it is unknown. According to hackers, it is different exploits. The problem is that Shadow Brokers require absolutely utter amounts: from 100 Zcash (for old exploits) and up to 16000 Zcash (for new). It approximately corresponds to range from 24 thousand to 3.8 million dollars. At the same time there were already cases when clients of Shadow Brokers publicly complained of uselessness purchased on a subscription - and for big money - the hacker^[3]

Shadow Brokers repeatedly tried to earn from tools of the NSA, it is unknown how been at their disposal. Having despaired them to sell, Brokers published part of them free of charge. Use active distribution of the malware using these exploits turned out to be a direct consequence of it - in particular, it is about epidemic of the encoder of WannaCry.

Afterwards Shadow Brokers started "service on a subscription", having earned from it several tens of thousands of dollars. But experts doubt that they will receive at least a small share of the fact that they demand now.

The logic of actions of Shadow Brokers at least is not always obvious — Dmitry Gvozdev, the CEO of Informatsionnye Tekhnologii Budushchego LLC considers. — Nobody in senses will want to pay millions for "pig in a poke", - even besides that tools of the NSA as he shows recent experience, quite working.

According to Gvozdev, Shadow Brokers could expect that intelligence agencies will become interested in their offer, but, considering that the most part of the offered tools already quite old, their value is hardly so high.

Notes