Equation Group

Background

Equation Group is the name given by Kaspersky Lab to a threat actor whose activity researchers traced back to at least 2001, and possibly earlier. Kaspersky described it as one of the most technically advanced cyberespionage groups it had ever analyzed, comparing its sophistication to the actors behind Stuxnet and Flame. The name "Equation" was chosen by Kaspersky researchers because of the group's extensive and unusual use of encryption algorithms throughout its malware and infrastructure.

Discovery and Public Disclosure

Kaspersky Lab publicly unveiled its findings on the Equation Group in February 2015, at the company's Security Analyst Summit, and published a detailed technical report through its Securelist research blog. The report described a toolkit that had been in active use for close to two decades, targeting government institutions, telecommunications companies, energy and aerospace firms, financial institutions, and research organizations in dozens of countries, with particular concentration in Iran, Russia, Pakistan, Afghanistan, and other regions of intelligence interest.

Tools and Capabilities

Kaspersky's analysis identified an extensive malware platform, including implants named EquationLaser, EquationDrug, DoubleFantasy, TripleFantasy, and GrayFish, as well as a self-replicating worm called Fanny that used two zero-day exploits later reused in Stuxnet. Perhaps the most striking capability documented was a module, internally referenced as nls_933w.dll, capable of reprogramming the firmware of hard drives from major manufacturers including Western Digital, Seagate, Toshiba, and Samsung. This allowed the creation of a hidden, persistent storage area on the drive that could survive disk reformatting and operating system reinstallation. The group also used USB-based command-and-control techniques designed to bridge air-gapped (offline) networks, and deployed a keylogging module known as GROK.

Links to the NSA

Kaspersky's report stopped short of formally naming a sponsor, but multiple technical and circumstantial indicators led researchers and journalists to connect the Equation Group to the U.S. National Security Agency, and specifically to its Tailored Access Operations (TAO) unit. These indicators included the presence of NSA internal codewords such as STRAITACID and STRAITSHOOTER inside malware samples, compile timestamps clustering around a Monday-to-Friday, 8 a.m.-to-5 p.m. Eastern Time work pattern, overlap with exploits later used in the NSA-linked Stuxnet operation, and the independent identification by security firm F-Secure of the hard-drive firmware tool as matching "IRATEMONK," a capability described in a leaked NSA ANT catalog document. A minor operational security lapse—a developer username, "RMGREE5," left inside some malware samples—was also noted by researchers as a clue during analysis.

The Shadow Brokers Leak

In August 2016, a previously unknown group calling itself "The Shadow Brokers" announced that it had stolen a cache of hacking tools belonging to the Equation Group and began auctioning and later publicly releasing portions of them. Kaspersky Lab confirmed that code and cryptographic quirks in the leaked files matched those found in previously analyzed Equation Group malware, lending credibility to the claim. Files within the leak indicated they dated to around June 2013, leading some, including NSA whistleblower Edward Snowden, to speculate that the breach or its discovery had prompted a security lockdown at the agency around that time. Subsequent Shadow Brokers releases in 2016 and 2017 included exploits such as EXTRABACON and, most consequentially, ETERNALBLUE, a Windows SMB exploit paired with the DOUBLEPULSAR backdoor.

Legacy and Significance

The tools leaked by the Shadow Brokers had an outsized real-world impact after their release. In May 2017, the WannaCry ransomware worm used the leaked EternalBlue exploit to spread rapidly across unpatched Windows systems worldwide, and the same exploit was reused weeks later in the destructive NotPetya attack in June 2017. The Equation Group episode is frequently cited in the security community as a landmark case illustrating both the scale of nation-state offensive cyber capability and the risk that such capabilities pose to global computer security once they are exposed or stolen.

Timeline

• 2001Kaspersky researchers later trace Equation Group activity back to at least this year, based on malware compilation timestamps and infrastructure analysis.
• 2015-02Kaspersky Lab publicly discloses and names the Equation Group at its Security Analyst Summit, publishing a detailed technical report on Securelist.
• 2015-02Kaspersky and other researchers document the group's hard-drive firmware reprogramming tool and its overlap with NSA capabilities described in leaked documents, fueling widespread attribution to the NSA.
• 2016-08A group calling itself The Shadow Brokers announces it has stolen Equation Group hacking tools and begins releasing samples and auctioning further files.
• 2017-04The Shadow Brokers publicly release a further tranche of tools including the ETERNALBLUE exploit and DOUBLEPULSAR backdoor.
• 2017-05The WannaCry ransomware worm spreads globally using the leaked ETERNALBLUE exploit.
• 2017-06The NotPetya destructive malware attack reuses the ETERNALBLUE exploit to spread across networks, primarily affecting Ukraine and multinational companies.