Some skepticism is always warranted with these things, but the prevailing belief in the security community is that this is very, very real. From Nicholas Weave

Some skepticism is always warranted with these things, but the prevailing belief in the security community is that this is very, very real. From Nicholas Weaver[1]: > Because of the sheer volume and quality, it is overwhelmingly likely this data is authentic. And it does not appear to be information taken from comprised systems. Instead the exploits, binaries with help strings, server configuration scripts, 5 separate versions of one implant framework, and all sort of other features indicate that this is analyst-side code­ -- the kind that probably never leaves the NSA. If you think for a minute about the motivations here, you can see that it would be absolutely idiotic for a state actor to release this kind of volume of their own exploits and malware frameworks. On the other hand, a state actor would love to release this information from their competitors' toolchest, as it virtually guarantees the entire set of exploits will quickly be rendered useless against high-profile targets. [1]: https://www.lawfareblog.com/very-bad-monday-nsa-0 https://www.lawfareblog.com/very-bad-monday-nsa-0