The NSA Leak Is Real, Snowden Documents Confirm

The evidence that ties the ShadowBrokers dump to the NSA comes in an agency manual for implanting malware, classified top secret, provided by Snowden, and not previously available to the public. The draft manual instructs NSA operators to track their use of one malware program using a specific 16-character string, “ace02468bdf13579.” That exact same string appears throughout the ShadowBrokers leak in code associated with the same program, SECONDDATE.
SECOND DATE plays a specialized role inside a complex global system built by the U.S. government to infect and monitor what one document estimated to be millions of computers around the world.

[...]

SECONDDATE is a tool designed to intercept web requests and redirect browsers on target computers to an NSA web server. That server, in turn, is designed to infect them with malware. SECONDDATE’s existence was first reported by The Intercept in 2014, as part of a look at a global computer exploitation effort code-named TURBINE. The malware server, known as FOXACID, has also been described in previously released Snowden documents.

https://prod01-cdn07.cdn.firstlook.org/wp-uploads/sites/1/2016/08/Screen-Shot-2016-08-18-at-6.21.41-PM-1000x744.png

▻https://www.documentcloud.org/documents/3031639-07-Introduction-to-BADDECISION-Redacted.html