On April 8, as part of a long, awkwardly worded rant about President Donald Trump's betrayal of his "base," the individual or individuals known as the Shadow Brokers posted the password to an encrypted archive containing what appear to be components of a toolkit associated with the National Security Agency's alleged Equation Group hacking campaign. But those hoping for even more spectacular exploits than those leaked earlier by the Shadow Brokers will likely be disappointed. However, the files do include a number of tools that may still be usable, as well as significant amounts of information about systems that appear to have been hacked by the NSA.

Many information security analysts were unimpressed.

The Shadow Brokers are the No Man's Sky of the hacker world. — Jonathan Nichols (@wvualphasoldier) April 9, 2017

In many respects, the files leaked earlier by the Shadow Brokers—in particular Cisco router and firewall exploits —were potentially far more damaging, as in many cases they worked against currently deployed Internet infrastructure. The tools in the master file, however, appear to be much older and targeted operating systems that are generally no longer in service—though some of the systems that they were apparently used to compromise are still online.

The archive, which the Shadow Brokers previously attempted to auction off, contains just over 300MB of files. It does not appear to contain the entire archive of Equation Group tools. Many of the tools apparently date back to the 1990s, targeting platforms like the Digital Equipment Corp., Alpha, Sun Solaris 2, the defunct Chinese Red Flag Linux, and other older Linux distributions. Other tools are apparently focused on telecom targets, including tools for getting into GSM cellular networks and breaking DES encryption.

In a teaser release last October, Shadow Brokers provided a list of files identifying host names and IP addresses for scores of systems that had apparently been compromised, as Ars previously reported. Those systems are included in the master archive that the Shadow Brokers provided the key for on Saturday, but there are many more that were not in the teaser dump. The contents of those folders have details of apparent breaches of the named systems, including the tool used, parameters used with the tool, and the date of the compromise.

The dates range between August of 2000 and August of 2010, referencing code names including Incision, Orangutan, Reticulum, Jackladder, and Patchicillin. Based on the files, a majority of the systems targeted appear to be Sun Solaris systems running on SPARC architecture.

The post from Shadow Brokers, entitled "Don't Forget Your Base," is (like previous posts) in strangely worded English and delivers a white-supremacist, isolationist, anti-"globalist" message, offering "constructive criticism" on Trump's recent policy moves, including the strike on Syria, and offering the password to the encrypted archive previously up for auction as "our form of protest."

Ars is continuing to examine the contents of the files and will post a more complete report soon.