Loading story…
Kaspersky reported that the tools released by ShadowBrokers bear strong technical hallmarks of the Equation Group, tying the leaked firewall exploits, scripts, and operational tooling to one of the most sophisticated known cyber-espionage arsenals. The strongest evidence came from a rare RC5/RC6 cryptographic implementation previously seen only in Equation malware, including the unusual use of the constant 0x61C88647 in a subtraction-based routine.
Researchers found 347 RC5/RC6 instances in the leaked archive, with more than 300 files using that specific RC6 variant across 24 forms, reinforcing the attribution with high confidence. The free archive released by ShadowBrokers contained roughly 300MB of material, mostly timestamped from August to October 2013, and some researchers said they were able to successfully test certain exploits, indicating that at least part of the leaked toolkit was operational and authentic.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Shadow Brokers published a new tranche of offensive cyber tools and implants, including Oddjob, Darkpulsar, Mofconfig, and PluginHelper. Researchers said the leak included evidence of targeting against Al Quds Bank for Development and Investment, and many of the implants were initially largely undetected by antivirus products.
Kaspersky analyzed the August 2016 leak and found strong technical evidence connecting the leaked tools to the Equation Group. The researchers identified a rare RC5/RC6 implementation previously seen only in Equation malware, including the unusual constant 0x61C88647, and concluded with high confidence that the leaked materials were related to the group.
A free archive of roughly 300MB containing firewall exploits, tools, and scripts was leaked by the ShadowBrokers. The files carried timestamps mostly from August to October 2013, and some researchers reported that certain exploits worked in testing.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
techcrunch.com
Open sourcearstechnica.com
Open sourcetheregister.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed new technical details on **Bvp47**, a stealthy Linux backdoor attributed to the **Equation Group**, after matching the malware’s RSA private key and framework components to material exposed in the **Shadow Brokers** leak. Pangu Lab said it originally recovered the implant during a 2013 forensic investigation into an intrusion it called *Operation Telescreen*, where attackers compromised internal servers and used an external relay host to pass commands, move payloads, and exfiltrate encrypted data. The malware used covert command-and-control over TCP `SYN` packets, obfuscation, and self-destruction features that helped it evade detection for more than a decade. The disclosure adds to a broader body of reporting on the Equation Group as one of the most advanced cyber-espionage operators observed, with Kaspersky previously linking the actor to a large arsenal of implants, firmware-level persistence, USB-based operations against air-gapped networks, and overlap with the **Stuxnet** and **Flame** ecosystems. Reporting on the Shadow Brokers dump also showed the group’s tooling included Windows exploitation frameworks, SMB-focused capabilities, and PowerShell-based payload delivery, while code-level similarities between Bvp47 and other Equation-linked malware further reinforced the attribution. Pangu said Bvp47 was used against more than **287 organizations in 45 countries**, including targets in telecom, military, education, economic, and scientific sectors.
Aug 15, 2026
Public research and reverse-engineering efforts exposed the architecture and capabilities of **DanderSpritz**, the Equation Group post-exploitation framework leaked by the Shadow Brokers. A GitHub documentation project cataloged decompiled Python components and resource files, mapping internal module names to functions including packet capture, memory dumping, keylogging, persistence, credential theft, SQL and Oracle database access, and remote command execution. The material also linked the framework to associated implants and components such as **DarkPulsar**, **DoubleFeature**, **DoormanGauze**, **PeddleCheap**, and **ZippyBang**. Check Point Research later expanded that picture with a deep technical analysis of **DoubleFeature**, a DanderSpritz logging plugin that revealed how the broader platform handled plugins, command execution, and collection. The researchers described an encrypted log file, a kernel driver named `hidsvc.sys` loaded via the **EpMe** exploit for **`CVE-2017-0005`**, and rootkit functionality that could invoke kernel APIs through IOCTLs while evading forensic tools. Their work also surfaced forensic artifacts and operational details tied to other Equation Group tools, including **UnitedRake**, **StraitBizarre**, **KillSuit**, **DiveBar**, **FlewAvenue**, **MistyVeal**, **DiceDealer**, and **PeddleCheap**.
Aug 15, 2026
Kaspersky detailed **EquationDrug** as the main long-running espionage platform used by the **Equation Group**, describing it as a highly sophisticated modular framework rather than a single Trojan. The malware family was tied to computer network exploitation activity dating back to at least 2001, and possibly earlier, with architecture and development artifacts indicating a disciplined, English-speaking team. Researchers said the platform combined kernel-mode and user-mode components with an orchestrator, encrypted storage, and dozens of selectively deployed plugins tailored to individual victims. The framework supported broad surveillance and intrusion functions, including file theft, screenshots, network interception, browser monitoring, keylogging, removable-media monitoring, NTFS forensics, passive network backdoors, and even HDD/SSD firmware manipulation. Kaspersky identified 30 plugin IDs and a wider ecosystem of supporting components such as `msndsrv.sys`, `mscfg32.exe`, `mscfg32.dll`, `tdip.sys`, `mstcp32.sys`, `msrtvd.sys`, `volrec.sys`, and `nls_933w.dll`, which were used for stealth, persistence, traffic filtering, audit-log suppression, and covert command execution. The report said EquationDrug was later superseded by the more advanced **GrayFish** platform.
Jun 29, 2026