A group called Shadow Brokers leaked a set of hacking tools in 2017, which led to massive security breaches around the world, including the ransomware attacks.
The group claimed to have stolen the tools from the US National Security Agency (NSA), but it was a mystery exactly how they got their hands on them. Now, a report from Symantec has revealed that the source may have been Chinese agents, who obtained the tools while the NSA was attacking their computers.
Symantec found that the Buckeye group (a codename for a Guangzhou-based contractor working for the Chinese Ministry of State Security) had been using stolen NSA tools for at least a year before the Shadow Brokers leak. Symantec believes the Buckeye group obtained the tools during an NSA attack and then used them to build their own version.
And it's logical that it's easy for the Buckeye group to manage to extract the tools, since according to an article in The New York Times, the NSA considers the group to be one of the most dangerous. The Buckeye group was tasked with attacking American space technology manufacturers and satellite and nuclear propulsion manufacturers.
If the source of the Shadow Brokers was indeed the Buckeye group, then this group was also indirectly responsible for the attacks carried out by North Korean and Russian hackers who used the repurposed tools to carry out attacks. The North Koreans hit the UK’s National Health Service and affected vaccine supplies, and Russian hackers took down critical Ukrainian services, including the postal system, airports, and ATMs.
Eric Chien, a security consultant at Symantec, told The New York Times that it is time for America to seriously consider the possibility that its enemies could capture and repurpose America’s hacking tools as they carry out attacks. In short, enemies of the American state could use these tools, paid for by American taxpayers, to attack US networks and infrastructure.
However, Symantec found no evidence that the Buckeye group used NSA tools against the NSA. The company believes that the group logically assumed that the NSA would have already developed defenses against its own weapons.
