More documents from the Edward Snowden leak have been published by The Intercept and they confirm a mysterious hacker group, The Shadow Brokers, did steal actual tools from the NSA. Included in the Snowden documents is a 16-character string that was supposed to be attached to SECONDDATE, one of the tools in the leak.
That string, which comes from the NSA, was found in the leak, essentially confirming the legitimacy of the hack.
SECONDDATE can be used to intercept traffic and redirect it to the NSA. It’s been used in Pakistan and Lebanon.
What remains unclear is who is responsible for the hack and the leak.
13) TL;DR: This leak looks like a somebody sending a message that an escalation in the attribution game could get messy fast.
— Edward Snowden (@Snowden) August 16, 2016