Kaspersky Lab identified an advanced persistent group the NSA had been quietly tracking when the ShadowBrokers leaked many of the NSA’s offensive tools in 2017. The NSA was using the tool to track 44 APT groups, many of them unknown and not publicly described at the time. The group, dubbed “DarkUniverse,” used spear-phishing emails to spread a malware tool that was designed to collect a wide range of information from infected systems, including keystrokes, emails, screenshots, and files from specific directories.”]