Loading story…
Kaspersky published an investigation report on a September 2014 incident in which Equation malware was detected on systems in the United States, revisiting one of the most closely watched nation-state malware cases tied to the highly sophisticated Equation threat actor. The report documents the circumstances of the detection and the handling of the malware sample, adding detail to a case that drew scrutiny because Equation has long been associated with advanced cyber-espionage capabilities and stealthy post-compromise tooling.
The disclosure highlights how a single malware detection can trigger broader concerns about attribution, sample handling, and the exposure of sensitive offensive cyber capabilities. By formally documenting the incident years later, Kaspersky provided additional context for defenders tracking legacy intrusions, advanced implants, and the operational risks posed when elite malware frameworks are discovered on victim networks or transferred beyond their original operators.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Securelist published an investigation report examining the September 2014 Equation malware detection incident in the U.S. The publication made details of the historical incident publicly available.
Kaspersky's report concerns an Equation malware detection incident in the United States that occurred in September 2014. This is the core real-world event referenced by the source.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky detailed a highly sophisticated cyber-espionage operation attributed to the **Equation Group**, describing a malware ecosystem with multiple toolsets, covert command-and-control methods, and the ability to maintain long-term access on victim networks. The report linked the group to a broad range of implants and frameworks used for surveillance, data theft, and lateral movement, and said its tradecraft ranked among the most advanced seen publicly at the time. A standout finding was the group’s apparent ability to reprogram hard drive firmware from major manufacturers, giving attackers persistence that could survive disk formatting, reinstallation, and operating system replacement. Researchers said the platform also used stealth techniques such as encrypted virtual file systems, hidden storage areas, and modular malware components, underscoring the risk posed by state-grade operators capable of embedding malicious functionality deep below the operating system layer.
Jul 12, 2026
Kaspersky detailed **EquationDrug** as the main long-running espionage platform used by the **Equation Group**, describing it as a highly sophisticated modular framework rather than a single Trojan. The malware family was tied to computer network exploitation activity dating back to at least 2001, and possibly earlier, with architecture and development artifacts indicating a disciplined, English-speaking team. Researchers said the platform combined kernel-mode and user-mode components with an orchestrator, encrypted storage, and dozens of selectively deployed plugins tailored to individual victims. The framework supported broad surveillance and intrusion functions, including file theft, screenshots, network interception, browser monitoring, keylogging, removable-media monitoring, NTFS forensics, passive network backdoors, and even HDD/SSD firmware manipulation. Kaspersky identified 30 plugin IDs and a wider ecosystem of supporting components such as `msndsrv.sys`, `mscfg32.exe`, `mscfg32.dll`, `tdip.sys`, `mstcp32.sys`, `msrtvd.sys`, `volrec.sys`, and `nls_933w.dll`, which were used for stealth, persistence, traffic filtering, audit-log suppression, and covert command execution. The report said EquationDrug was later superseded by the more advanced **GrayFish** platform.
Jun 29, 2026
Kaspersky reported that the tools released by **ShadowBrokers** bear strong technical hallmarks of the **Equation Group**, tying the leaked firewall exploits, scripts, and operational tooling to one of the most sophisticated known cyber-espionage arsenals. The strongest evidence came from a rare `RC5/RC6` cryptographic implementation previously seen only in Equation malware, including the unusual use of the constant `0x61C88647` in a subtraction-based routine. Researchers found **347** `RC5/RC6` instances in the leaked archive, with more than **300 files** using that specific `RC6` variant across **24** forms, reinforcing the attribution with high confidence. The free archive released by ShadowBrokers contained roughly **300MB** of material, mostly timestamped from **August to October 2013**, and some researchers said they were able to successfully test certain exploits, indicating that at least part of the leaked toolkit was operational and authentic.
Jun 29, 2026