Yes, however the contents of the free sample seems very real. Without having dug into the binaries it's hard to tell, but it's hard to imagine someone wrote this to scam 1 million BTC out of the net.
Let's say you break into a server and steal 10 vulnerabilities, from an organization (e.g. the NSA) who are never going to acknowledge how many vulnerabilities they had or were stolen.
If you want to get the most in the auction, the best thing you could possibly do is to release all 10 of your vulnerabilities for free, claiming that it's just a teaser, and that you have many more. Then you take in bids and disappear. It makes no sense to only release 2 or 3 and hold back the remainder; the unreleased ones are essentially wasted because they didn't actually contribute to any bidding activity: nobody knew they existed when they were bidding. That they exist at all is a happy surprise to the winning bidder, but with no further sales, customer goodwill isn't worth anything.
There's really no incentive to actually follow through on the sale at all. The only purpose of the "goods" to the seller is to attract bids, but with nobody to verify what's actually for sale, the best strategy is to use everything for what amounts to advertising, in the hope of gaining more attention and attracting more bids.
I wouldn't dump it all at once, if I were them, though. I'd do an initial release, and them some more once the initial bids (if there are any) slow down, and keep doing that over and over until the market is entirely worn out and all the vulnerabilities have been disclosed. That's the profit-maximizing strategy, I think.
People do work for a lot less..
However, with that much money on the line (if that figure is correct), you could fake almost anything.
The block chain makes it worse because everyone can see the progress of the buyer and there's no market maker with anywhere near this level of liquidity.
Interesting to note: there has been no new Bitcoin block for the last 1 hour 23 minutes. This happens from time to time, but it is a little suspicious.
The only people who could verify if it's real are the Equation Group themself. For anyone else it's impossible to verify - it's just some names.
So: If it's real the Equation Group will bid - probably a lot. If it's fake no one will bid.
So it'll be easy to tell which it is.
> So it'll be easy to tell which it is.
~~How can you tell how others have bid?~~
Why? You have no guarantee what you're bidding for will remain private, and you don't want to give it legitimacy by bidding. Who's to say if it's real the Equation Group wouldn't bid, under the assumption that it's already out there and you have absolutely no guarantees that anyone you're dealing with would keep their word.
Some systems you can get into some you can't.