Loading story…
Kaspersky detailed EquationDrug as the main long-running espionage platform used by the Equation Group, describing it as a highly sophisticated modular framework rather than a single Trojan. The malware family was tied to computer network exploitation activity dating back to at least 2001, and possibly earlier, with architecture and development artifacts indicating a disciplined, English-speaking team. Researchers said the platform combined kernel-mode and user-mode components with an orchestrator, encrypted storage, and dozens of selectively deployed plugins tailored to individual victims.
The framework supported broad surveillance and intrusion functions, including file theft, screenshots, network interception, browser monitoring, keylogging, removable-media monitoring, NTFS forensics, passive network backdoors, and even HDD/SSD firmware manipulation. Kaspersky identified 30 plugin IDs and a wider ecosystem of supporting components such as msndsrv.sys, mscfg32.exe, mscfg32.dll, tdip.sys, mstcp32.sys, msrtvd.sys, volrec.sys, and nls_933w.dll, which were used for stealth, persistence, traffic filtering, audit-log suppression, and covert command execution. The report said EquationDrug was later superseded by the more advanced GrayFish platform.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Kaspersky's analysis indicates EquationDrug was the Equation Group's primary long-running espionage platform, with operations dating back to at least 2001 and possibly the 1990s. The framework was used as a modular cyberespionage platform rather than a simple Trojan.
On March 12, 2015, Securelist published Kaspersky's detailed research describing EquationDrug's architecture, plugins, supporting drivers and DLLs, and its extensive surveillance and persistence capabilities. The report characterized the malware as a highly sophisticated, customizable espionage framework linked to the Equation Group.
The report states that EquationDrug was eventually replaced by the more advanced GrayFish platform, marking an evolution in the Equation Group's espionage tooling. No precise replacement date is provided in the reference.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Equation Group** operated a highly modular espionage platform across **Windows, Linux, and Solaris/SPARC**, extending the reach of its long-running **EquationDrug** toolset beyond previously documented Windows infections. Analysis identified a **Linux x86 DoubleFantasy** implant used for target validation and reconnaissance, alongside **Solaris SPARC** components including a rootkit and a Solaris **DoubleFantasy** module for persistence, host profiling, concealment, and remote command execution. The Solaris malware was described as capable of hiding files, processes, and services, installing startup scripts, generating hidden directories from host-specific values, and decrypting embedded payloads for execution. The findings tie the non-Windows implants to the broader EquationDrug ecosystem through shared custom encryption logic and the same **16-byte key material** previously associated with Windows **DoubleFantasy** communications and registry encryption. Separate analysis of EquationDrug described a mature espionage framework with kernel- and user-mode components, encrypted storage, plugin-based extensibility, process injection, audit-log suppression, passive network backdoors, and capabilities including file theft, screenshots, keylogging, browser monitoring, removable-media surveillance, and even **HDD/SSD firmware manipulation**. Investigators also linked the Solaris tooling to command-and-control infrastructure, including the domain **`xxxech.com`** and an IP address in the same subnet as Windows-related infrastructure, reinforcing the assessment that Equation Group maintained a sophisticated, multi-platform cyberespionage capability.
Aug 15, 2026
Kaspersky detailed a highly sophisticated cyber-espionage operation attributed to the **Equation Group**, describing a malware ecosystem with multiple toolsets, covert command-and-control methods, and the ability to maintain long-term access on victim networks. The report linked the group to a broad range of implants and frameworks used for surveillance, data theft, and lateral movement, and said its tradecraft ranked among the most advanced seen publicly at the time. A standout finding was the group’s apparent ability to reprogram hard drive firmware from major manufacturers, giving attackers persistence that could survive disk formatting, reinstallation, and operating system replacement. Researchers said the platform also used stealth techniques such as encrypted virtual file systems, hidden storage areas, and modular malware components, underscoring the risk posed by state-grade operators capable of embedding malicious functionality deep below the operating system layer.
Jul 12, 2026
Public research and reverse-engineering efforts exposed the architecture and capabilities of **DanderSpritz**, the Equation Group post-exploitation framework leaked by the Shadow Brokers. A GitHub documentation project cataloged decompiled Python components and resource files, mapping internal module names to functions including packet capture, memory dumping, keylogging, persistence, credential theft, SQL and Oracle database access, and remote command execution. The material also linked the framework to associated implants and components such as **DarkPulsar**, **DoubleFeature**, **DoormanGauze**, **PeddleCheap**, and **ZippyBang**. Check Point Research later expanded that picture with a deep technical analysis of **DoubleFeature**, a DanderSpritz logging plugin that revealed how the broader platform handled plugins, command execution, and collection. The researchers described an encrypted log file, a kernel driver named `hidsvc.sys` loaded via the **EpMe** exploit for **`CVE-2017-0005`**, and rootkit functionality that could invoke kernel APIs through IOCTLs while evading forensic tools. Their work also surfaced forensic artifacts and operational details tied to other Equation Group tools, including **UnitedRake**, **StraitBizarre**, **KillSuit**, **DiveBar**, **FlewAvenue**, **MistyVeal**, **DiceDealer**, and **PeddleCheap**.
Aug 15, 2026