: Cisco Talos released a detailed Technical Analysis of Shadow Brokers Exploits, which covers how ExtraBed acts as an installable backdoor module to manipulate the ASA's configuration and authentication logic.

: Its ability to reside in memory without writing to the disk, making it difficult to detect with standard file system audits.

While academic "papers" specifically titled "ExtraBed.rar" are rare (as the name refers to the leaked file itself), the following industry-standard reports provide the depth you are likely seeking:

When reviewing these papers, focus on these specific ExtraBed mechanisms: