This undated NSA paper describes a project to recognise and process data that comes from third party attacks on computers: see the Der Spiegel article The Digital Arms Race: NSA Preps America for Future Battle, 17 January 2015.

These two pages from a 2004 NSA briefing document describes two trojan implants used with the FOXACID system: see the Der Spiegel article NSA-Totalausspähung: FDP-Politiker Baum setzt auf Generalbundesanwalt, 1 January 2014.

This undated NSA SIGINT presentation describes nine varieties of QUANTUM malware attack, their operational status and success in the field: see the Intercept article How the NSA Plans to Infect ‘Millions’ of Computers with Malware, 12 March 2014.

This NSA presentation describes the staffing and activities of the Tailored Access Operations sectio based in San Antonia Texas. These included operations against Mexico’s Secretariat of Public Security (codenamed WHITETAMALE), Cuba, Columbia, Venezuela and unspecified targets in the Middle East: see the Der Spiegel article Inside TAO: Documents Reveal Top NSA Hacking Unit, 29 December […]

This NSA presentation from December 2010 forms the second part of a course in using the agency’s CNE tools: see the Intercept article The NSA Leak is Real, Snowden Documents Confirm, 19 August 2016.

This Booz Allen Hamilton presentation on the NSA’s Quantum tools describes the different kinds of malware attacks available to workgroups within the agency, the procedure an analyst must follow in order to make use of them and the way the systems themselves work, using a “man-on-the-side” attack from TAO’s FOXACID server. It also describes the […]

This short extract from an April 2011 NSA document describes the operation of the agency’s QUANTUMHAND tool: see the Intercept article Compare the NSA’s Facebook Malware Denial to its Own Secret Documents, 15 March 2014.

Ths undated set of annotated screenshots from XKeyScore provides a worked example of a search: see the Intercept article XKEYSCORE: NSA’s Google for the World’s Private Communications, 1 July 2015.

This December 2010 instructional presentation explains how to use the see the BADDECISION tool to redirect web traffic to a FOXACID server: see the Intercept article The NSA Leak is Real, Snowden Documents Confirm, 19 August 2016.

An NSA presentation on the FOXACID system used to redirect web traffic in order to deliver malware to a target machine. The image on the first slide plays on the original delivery method used to compromise targets: spam emails. Those conventional phishing attacks (such as WILLOWVIXEN) have become deprecated in the agency’s offensive arsenal in […]

This 26 September 2011 article from the NSA’s internal newsletter Special Source Operations News discusses the delivery of QUANTUMINSERT malware to a target in Pakistan: see the Intercept article The NSA Leak is Real, Snowden Documents Confirm, 19 August 2016.

This draft NSA report on using the agency’s FOXACID system confirms that malware code released by the ShadowBrokers did, in fact, originate from the NS see the Intercept article The NSA Leak is Real, Snowden Documents Confirm, 19 August 2016.