OK, hyperbola aside, stumbling, as in finding the tools still there, and yes, what you said is one of the many possible examples certain people are pushing. Looking at the addresses of all those command and control servers, however, it literally could have been anyone else from any country in the world, regardless of who they were attacking. What are the chances the one with the bad clean-up job is the one found by Russian govt specifically. Esp since they were targeting routers, presumably any response team/curious admin, or one of the million scaning haxors could have either followed the crumbs, or simply stumbled upon the doors left open at the cc end.
Or there's this hypothesis: http://arstechnica.com/security/2016/08/hints-suggest-an-ins...
Which makes a hell of a lot more sense than assuming any of the aforementioned (not least any of the smaller subset of said unlikely scenarios leading to PUTIN).
Re:Shadow brokers dump more NSA data
by jlgaddis on Wednesday November 02, 2016 @07:07PM
(#12860216)
Oh, I completely agree with you that what I described is not very likely to be what happened here. There are a number of other theories that are much more likely (including things like you described), I just don't think that "my scenario" can be completely ruled out. Stranger things have happened.
Imagine you're working in IT or InfoSec for the Russian (or any other state/national) government. You see attacks coming in from IP addresses in another country -- maybe they were successful and you're investigating a compromised host. You find these IP addresses in the logs, do some investigating and find the host that attacked you is running a vulnerable version of sendmail (for example). So you compromise the host as well and, once you get in, you find the previously released exploits and such sitting in a user's home directory.
I don't think this scenario is that outlandish.