← Back to Index

National Security / Cyber Operations

US Military-Grade Cyberweapons

The documented arsenal — NSA exploits, CIA malware, leaked toolkits, and what happened when America's most powerful digital weapons escaped government control.

NSA / CIA / Cybercom

The Architecture of US Cyber Power

The United States operates the most sophisticated state cyber program on earth — a layered apparatus spanning the National Security Agency's Tailored Access Operations (TAO) division, the CIA's Center for Cyber Intelligence (CCI), and the military's US Cyber Command (CYBERCOM). Together, these agencies develop, stockpile, and deploy offensive cybertools against adversaries — and, as multiple leaks have confirmed, against allies and domestic infrastructure as well.

What distinguishes US cyber capability is not just technical sophistication but the legal and institutional apparatus that supports it: NSA's FISA authorities, the President's executive covert action findings, and Title 10 authorities that allow CYBERCOM to conduct offensive operations with limited oversight compared to traditional military kinetic action.

Classification Framework
US offensive cyber operations are classified under compartmented programs with names like GENIE (global network exploitation), TURBINE (automated implant management at scale), and FOXACID (man-on-the-side network injection). Most details remain classified; what is known comes from Snowden documents, Shadow Brokers releases, and Vault 7.

The Major Weapons — Documented

STUXNET
NSA + Unit 8200 (Israel) — Operation OLYMPIC GAMES — ~2005–2010
The first publicly known cyberweapon designed to cause physical destruction. Stuxnet targeted Siemens programmable logic controllers (PLCs) at Iran's Natanz uranium enrichment facility, causing centrifuges to spin at destructive speeds while feeding operators false "all normal" readings. It used four zero-day exploits simultaneously — an unprecedented number — and spread via USB drives to reach air-gapped networks. Accidentally spread beyond its target when a Siemens engineer connected an infected laptop to the internet, alerting security researchers worldwide.
Blowback: When Stuxnet leaked, it provided nation-states and criminal groups a template for ICS/SCADA attacks. Its code was reverse-engineered and components repurposed by multiple threat actors.
ETERNALBLUE + DOUBLEPULSAR
NSA Tailored Access Operations — Leaked by Shadow Brokers — April 2017
EternalBlue exploits a critical vulnerability in Windows' SMBv1 protocol (MS17-010), allowing remote code execution without credentials. DoublePulsar is a kernel-level backdoor implant that EternalBlue drops as a payload. Together, they allow complete control of any unpatched Windows machine on a network. The NSA had discovered and weaponized this vulnerability years before Microsoft was notified — stockpiling it as an offensive tool while millions of Windows systems remained unpatched and vulnerable.
Blowback: After the Shadow Brokers leak, these tools were incorporated into WannaCry (North Korea, May 2017) and NotPetya (Russia/GRU, June 2017). NotPetya caused an estimated $10 billion in global damages — the most costly cyberattack in history. Maersk, FedEx, Merck, and Mondelez were among hundreds of companies devastated. Microsoft's Brad Smith publicly condemned the NSA for stockpiling the vulnerability.
VAULT 7 — CIA CCI TOOLKIT
CIA Center for Cyber Intelligence — Leaked via WikiLeaks — March 2017
8,761 documents describing the CIA's entire offensive cyber toolkit, leaked by former contractor Joshua Schulte (convicted 2022). Included: Weeping Angel (Samsung Smart TV microphone activation in "fake off" mode), Marble Framework (obfuscation tool to disguise CIA malware as Russian, Chinese, or Arabic-origin code), Angelfire (Windows bootkit), Grasshopper (modular Windows malware builder), and over 1,000 malware systems and exploit frameworks targeting iOS, Android, Windows, macOS, and smart devices.
Blowback: Marble Framework's exposure showed foreign intelligence services how the CIA disguised its operations — potentially burning years of cover. The "Weeping Angel" capability alerted adversaries to check consumer devices for state implants. Chinese and North Korean APTs were observed adapting CIA techniques within months of the leak.
PRISM + UPSTREAM (XKeyscore)
NSA — Exposed by Edward Snowden — June 2013
PRISM was a court-authorized program (under FISA Section 702) giving NSA direct access to data held by Google, Apple, Microsoft, Facebook, Yahoo, Skype, YouTube, and AOL. UPSTREAM collected data directly from internet backbone fiber cables. XKeyscore was the analytical interface — described internally as "the widest-reaching" NSA system for developing intelligence from the internet, capable of searching emails, browser history, metadata, and content of billions of communications in near-real-time.
Blowback: Diplomatic crisis with Germany, Brazil, and EU allies whose leaders were surveilled. The EU subsequently invalidated the US-EU Safe Harbor data transfer framework. Domestic reform led to USA FREEDOM Act (2015), though most collection authorities were retained.
TURBINE / QUANTUM / FOXACID
NSA TAO — Revealed via Snowden documents — 2013–2014
TURBINE is an automated implant management platform that allowed NSA to scale from hundreds to millions of individually managed malware implants globally. QUANTUM performs "man-on-the-side" attacks — racing legitimate web servers to inject malicious responses when targets visit certain websites. FOXACID is the exploit server infrastructure that QUANTUM redirects targets to, delivering browser-based zero-day payloads. These programs enabled NSA to implant malware at internet scale without direct network access.
Blowback: After exposure, major platforms began enforcing HTTPS by default, making QUANTUM-style injection significantly harder. China and Russia accelerated development of analogous capabilities.

The Shadow Brokers: When the Arsenal Went Public

In August 2016, a group calling itself the Shadow Brokers began releasing NSA hacking tools, initially auctioning them before dumping the full toolkit publicly in April 2017. The identity of the Shadow Brokers remains officially unconfirmed; US intelligence assessments and independent researchers point to Russian intelligence (GRU or SVR) as the source.

The April 2017 dump — "Lost in Translation" — contained EternalBlue, DoublePulsar, and over 300 other NSA tools. Within weeks, criminal and state actors had weaponized EternalBlue. The WannaCry and NotPetya attacks followed within two months.

The Blowback Problem
The fundamental tension in offensive cyber: every weapon the US builds and stockpiles is a weapon that can be stolen, leaked, or independently discovered by adversaries. Unlike kinetic weapons, cyberweapons are copyable — once a zero-day is known, every technically capable actor can build their own version. The NSA's stockpiling of EternalBlue for years before disclosure directly enabled two of the most damaging cyberattacks in history.

CYBERCOM's Offensive Posture — "Defend Forward"

In 2018, the Trump administration declassified a new cyber strategy: "Defend Forward" — meaning US Cyber Command would now actively operate inside adversary networks, not merely defend US systems. CYBERCOM would "contest malicious cyber activity before it reaches US networks."

Concrete documented operations under this doctrine include:

The Vulnerability Equities Process — Who Decides?

When the NSA or other agencies discover a zero-day vulnerability, they must decide: disclose it to the vendor (eliminating the threat for everyone) or keep it secret for offensive use (exploiting it until someone else finds it or it leaks). This decision is governed by the Vulnerability Equities Process (VEP), an interagency framework established after Snowden.

Critics argue the VEP systematically favors offensive retention over defensive disclosure, leaving millions of Americans using vulnerable software to enable intelligence operations. The EternalBlue case is the canonical argument for reform: the NSA sat on the vulnerability for years, it was stolen, and it caused $10 billion in global damage.

"We cannot allow the Internet to be used as a weapon against us, while we use it as a weapon against others, with no acknowledgment of the contradiction."

— Former NSA Director Michael Hayden (paraphrased), Council on Foreign Relations, 2017

Primary Sources & Further Reading