The next focal point is a “brokers”. The broker is also called as “broker” in Japan, though it is used for the special term to the security broker or the real estate broker, while the general intermediator is not called as such. It implies they have conducted a job descripted as the broker in Japanese term.
This consideration narrows down their possible profile. Their business should not be security and real estate brokers and I came up with one possibility that they are smugglers or human traffickers. They are called as the underground import broker in Japanese term.
In the end, the broker is often used by the criminal. The illegal transporter is almost always called as such in Japan, and then researching further into the detail, I found out which criminals they should belong to. That is the data broker.
“Shadow brokers” are data brokers, partially accumulating their data by hacking into the corporate server. This skill-set is transformed to the ransomware, as they had to find a new source of income after the regulation was tightened after the massive leak of personal information in 2014 when tens of million data was leaked by the inside job. This leaked data was sold to the data broker, which was resold in the market. That is why the regulation was tightened and they needed to find another source of income.
I assume that was one of the motivations why they started to employ a ransomware, as they already had a capability of hacking. All in all, this is a profile of “shadow brokers”.
FFF 