{
	"id": "83c74c8d-36d2-4f35-b9b0-98f1798b0c16",
	"created_at": "2026-04-06T00:09:01.97662Z",
	"updated_at": "2026-04-10T13:12:14.530421Z",
	"deleted_at": null,
	"sha1_hash": "98bf05fa58327275d2454d6cd0a0f0e135c39bd6",
	"title": "The Full Story of the Stunning RSA Hack Can Finally Be Told",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 2000733,
	"plain_text": "The Full Story of the Stunning RSA Hack Can Finally Be Told\r\nBy Andy Greenberg\r\nPublished: 2021-05-20 · Archived: 2026-04-05 16:39:21 UTC\r\nIn 2011, Chinese spies stole the crown jewels of cybersecurity—stripping protections from firms and government\r\nagencies worldwide. Here’s how it happened.\r\nIllustration: Eduardo Ramón Trejo; Getty Images; Alamy\r\nAll products featured on WIRED are independently selected by our editors. However, we may receive\r\ncompensation from retailers and/or from purchases of products through these links. Learn more.\r\nAmid all the sleepless hours that Todd Leetham spent hunting ghosts inside his company’s network in early 2011,\r\nthe experience that sticks with him most vividly all these years later is the moment he caught up with them. Or\r\nalmost did.\r\nYou’ve read your last free article.\r\nhttps://www.wired.com/story/the-full-story-of-the-stunning-rsa-hack-can-finally-be-told/\r\nPage 1 of 3\n\nThe intersection of technology, power, and culture. Start your free trial and get access to 5 all-new premium\r\nnewsletters—cancel anytime.\r\nSTART FREE TRIAL\r\nAlready a subscriber? Sign In\r\nThe intersection of technology, power, and culture. Start your free trial and get access to 5 all-new premium\r\nnewsletters START FREE TRIAL\r\nhttps://www.wired.com/story/the-full-story-of-the-stunning-rsa-hack-can-finally-be-told/\r\nPage 2 of 3\n\nAndy Greenberg is a senior writer for WIRED covering hacking, cybersecurity, and surveillance. He’s the author\r\nof the books Tracers in the Dark: The Global Hunt for the Crime Lords of Cryptocurrency and Sandworm: A New\r\nEra of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers. His books ... Read More\r\nGet The Big Story in Your Inbox\r\nThe most ambitious, future-defining stories from our favorite writers.\r\nSource: https://www.wired.com/story/the-full-story-of-the-stunning-rsa-hack-can-finally-be-told/\r\nhttps://www.wired.com/story/the-full-story-of-the-stunning-rsa-hack-can-finally-be-told/\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.wired.com/story/the-full-story-of-the-stunning-rsa-hack-can-finally-be-told/"
	],
	"report_names": [
		"the-full-story-of-the-stunning-rsa-hack-can-finally-be-told"
	],
	"threat_actors": [
		{
			"id": "8941e146-3e7f-4b4e-9b66-c2da052ee6df",
			"created_at": "2023-01-06T13:46:38.402513Z",
			"updated_at": "2026-04-10T02:00:02.959797Z",
			"deleted_at": null,
			"main_name": "Sandworm",
			"aliases": [
				"IRIDIUM",
				"Blue Echidna",
				"VOODOO BEAR",
				"FROZENBARENTS",
				"UAC-0113",
				"Seashell Blizzard",
				"UAC-0082",
				"APT44",
				"Quedagh",
				"TEMP.Noble",
				"IRON VIKING",
				"G0034",
				"ELECTRUM",
				"TeleBots"
			],
			"source_name": "MISPGALAXY:Sandworm",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "7bd810cb-d674-4763-86eb-2cc182d24ea0",
			"created_at": "2022-10-25T16:07:24.1537Z",
			"updated_at": "2026-04-10T02:00:04.883793Z",
			"deleted_at": null,
			"main_name": "Sandworm Team",
			"aliases": [
				"APT 44",
				"ATK 14",
				"BE2",
				"Blue Echidna",
				"CTG-7263",
				"FROZENBARENTS",
				"G0034",
				"Grey Tornado",
				"IRIDIUM",
				"Iron Viking",
				"Quedagh",
				"Razing Ursa",
				"Sandworm",
				"Sandworm Team",
				"Seashell Blizzard",
				"TEMP.Noble",
				"UAC-0082",
				"UAC-0113",
				"UAC-0125",
				"UAC-0133",
				"Voodoo Bear"
			],
			"source_name": "ETDA:Sandworm Team",
			"tools": [
				"AWFULSHRED",
				"ArguePatch",
				"BIASBOAT",
				"Black Energy",
				"BlackEnergy",
				"CaddyWiper",
				"Colibri Loader",
				"Cyclops Blink",
				"CyclopsBlink",
				"DCRat",
				"DarkCrystal RAT",
				"Fobushell",
				"GOSSIPFLOW",
				"Gcat",
				"IcyWell",
				"Industroyer2",
				"JaguarBlade",
				"JuicyPotato",
				"Kapeka",
				"KillDisk.NCX",
				"LOADGRIP",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"ORCSHRED",
				"P.A.S.",
				"PassKillDisk",
				"Pitvotnacci",
				"PsList",
				"QUEUESEED",
				"RansomBoggs",
				"RottenPotato",
				"SOLOSHRED",
				"SwiftSlicer",
				"VPNFilter",
				"Warzone",
				"Warzone RAT",
				"Weevly"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434141,
	"ts_updated_at": 1775826734,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/98bf05fa58327275d2454d6cd0a0f0e135c39bd6.pdf",
		"text": "https://archive.orkl.eu/98bf05fa58327275d2454d6cd0a0f0e135c39bd6.txt",
		"img": "https://archive.orkl.eu/98bf05fa58327275d2454d6cd0a0f0e135c39bd6.jpg"
	}
}