Almost all of their code for any of the back doors / 0days / etc comes directly from MetaSploit POC's.

Their remote injection is almost 100% copy paste from other locations...

I almost feel let down :( I mean this is something I would have expected from script kiddies... not from such a well used hacking firm. I don't think I have come across a single thing that I have not seen elsewhere. I need to start a hacking company / front end to metasploit and profit too!

Edit : file is now available at : https://mega.nz/#!tA0EkbZB!igyauwYglvUihej_m4K_RTFsYMZw80Aq1DHz_i-qOU8

Many users have trouble downloading the torrent, because of the large size of the torrent file itself (23 MB), I have created a torrent file that is much smaller (1.2 MB) with the same content.

Differences

• I have zipped some files together, so you no longer have 200k different files to download. This also reduced the size to 2/3

• I have zipped the E-mail archives individually, because pst files can be compressed to about 50% of their original size.

• I have doubled the piece size from 2 to 4 MB, so the number of hashes in the torrent file is further reduced.

Result

You get the same content, need less space and can download it with every client I know.

Files

• magnet link on pastebin (with trackers)

• magnet link without trackers: magnet:?xt=urn:btih:a5d140a40b091972dfe156663940ecf4a1390349

• Torrent file

I try to get this up on my seedbox within the next 24 hours.

Note

I have not altered any files in the torrent itself. If you extract everything, you get the exact same content as you would with the 23 MB monster torrent. This might not apply to thumbs.db files, because windows reads them and might modify them, but they are only a cache to show thumbnails faster. So they are useless to you anyways.

Did anyone notice that there's a "$recycle.bin folder.. Doesn't that conclude that the drive was imaged?

Exfiltrating 400 GB out of the network does seem difficult to hide.

Anyone has thoughts on this?