However, their command of English is almost certainly pretty good, seeing how they use somewhat fancy words ("closing remarks") appropriately and clearly know English idiom well ("When we feel is time to end" - using "feel" in that phrase is sufficiently peculiar to English that I wouldn't expect it from anyone who thinks in another language and translates in their head more or less mechanically). This makes it harder to rule out that the "free" file consists of exploits they collected on the market and doctored to give them a more NSAish veneer.
> Q: What is in auction files? A: Is secret.
> Q: When does auction end? A: Unknown. When we feel is time to end.
A native speaker would say "it's secret" or "it's a secret", or "when we feel it's time [to end it]".
Granted, the text seems a bit like someone imitating a Russian who speaks broken English from the movies. It may well be misdirection. It's possible that non-native speakers from other languages also make this mistake, but I have seen it commonly with Slavic speakers.
This is typical of mandarin chinese; the verbs 觉得 and 感觉 are "feel" in a literal sense, but mean "think (something)".
If one language uses a metaphor, odds are some other languages do too.
> You wanted to know who I am, Zero Cool? Well, let me explain the New World Order. Governments and corporations need people like you and me. We are Samurai... the Keyboard Cowboys... and all those other people out there who have no idea what's going on are the cattle... Moooo.
Anyway, they painted a huge target on their back if this is real NSA stuff. I can't see how they would cash-out any significant bitcoin amount ($100k+) without being traced.
For complete anonymization, they need a little patience.
In the near future, they can buy ZCash.
In the distant future, they can probably move the money into a MimbleWimble based sidechain.
OK, now you're just making up words...
Btw, if you're in Germany, you might still have a chance to get an anonymous prepaid SIM in the next weeks before the carriers adapt to the legal change - you can use that, too.
http://shop.tescomobile.com/pay-monthly/sim-only/Tesco+Mobil...
With roaming in the EU becoming free mid-2017, and Brexit not coming into effect til 2019, the whole EU will still be well covered by anonymous prepaid.
Just like they sent a takedown to every site hosting content from the shadowbreakers, they might just send a SWAT team to every Tor node your data ran through, and try to track you.
And that's in addition to whatever TAO has in their reportoire.
The lack of definite articles and linking verbs is particularly suggestive of a Slavic background. Here's another telling signature:
We follow Equation Group traffic. We find Equation Group source range. We hack Equation Group.
So instead of using the standard "linking verb + gerund" construction that modern English provides to indicate continual (or background) activity they're using the simple present tenses of these verbs the way Slavic languages do, via the imperfective forms of these verbs.
And also:
If you want reverse, write many words, make big name for self, get many customers, you send bitcoin.
You bid against Equation Group, win and find out or bid pump price up, piss them off, everyone wins.
You like reward, you take risk, maybe win, maybe not, no guarantees.
The use of commas to link independent clauses (instead of coordinating conjunctions, like English) also happens to be very characteristic of Russian.
Also I am guessing in a group of computer literate people, from Eastern Europe, they couldn't find one person with a better handle on English grammar and phraseology.
If anything stands out from the writing to me it's that it sounds like a scam.
BTW, it should be "the files".
Of course, the seller could always be pretending. Given the seeming authenticity of the leak however, it's doubtful they're western—unless they're operating very illegally and trying to cover their tracks.