Loading story…
Kaspersky detailed a highly sophisticated cyber-espionage operation attributed to the Equation Group, describing a malware ecosystem with multiple toolsets, covert command-and-control methods, and the ability to maintain long-term access on victim networks. The report linked the group to a broad range of implants and frameworks used for surveillance, data theft, and lateral movement, and said its tradecraft ranked among the most advanced seen publicly at the time.
A standout finding was the group’s apparent ability to reprogram hard drive firmware from major manufacturers, giving attackers persistence that could survive disk formatting, reinstallation, and operating system replacement. Researchers said the platform also used stealth techniques such as encrypted virtual file systems, hidden storage areas, and modular malware components, underscoring the risk posed by state-grade operators capable of embedding malicious functionality deep below the operating system layer.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published Kaspersky's report describing the Equation Group as an advanced threat actor with a large malware framework and extensive cyber-espionage capabilities. The publication publicly disclosed technical details of the campaign and its toolset.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky detailed **EquationDrug** as the main long-running espionage platform used by the **Equation Group**, describing it as a highly sophisticated modular framework rather than a single Trojan. The malware family was tied to computer network exploitation activity dating back to at least 2001, and possibly earlier, with architecture and development artifacts indicating a disciplined, English-speaking team. Researchers said the platform combined kernel-mode and user-mode components with an orchestrator, encrypted storage, and dozens of selectively deployed plugins tailored to individual victims. The framework supported broad surveillance and intrusion functions, including file theft, screenshots, network interception, browser monitoring, keylogging, removable-media monitoring, NTFS forensics, passive network backdoors, and even HDD/SSD firmware manipulation. Kaspersky identified 30 plugin IDs and a wider ecosystem of supporting components such as `msndsrv.sys`, `mscfg32.exe`, `mscfg32.dll`, `tdip.sys`, `mstcp32.sys`, `msrtvd.sys`, `volrec.sys`, and `nls_933w.dll`, which were used for stealth, persistence, traffic filtering, audit-log suppression, and covert command execution. The report said EquationDrug was later superseded by the more advanced **GrayFish** platform.
Jun 29, 2026
Researchers reported that the **Equation Group** operated a highly modular espionage platform across **Windows, Linux, and Solaris/SPARC**, extending the reach of its long-running **EquationDrug** toolset beyond previously documented Windows infections. Analysis identified a **Linux x86 DoubleFantasy** implant used for target validation and reconnaissance, alongside **Solaris SPARC** components including a rootkit and a Solaris **DoubleFantasy** module for persistence, host profiling, concealment, and remote command execution. The Solaris malware was described as capable of hiding files, processes, and services, installing startup scripts, generating hidden directories from host-specific values, and decrypting embedded payloads for execution. The findings tie the non-Windows implants to the broader EquationDrug ecosystem through shared custom encryption logic and the same **16-byte key material** previously associated with Windows **DoubleFantasy** communications and registry encryption. Separate analysis of EquationDrug described a mature espionage framework with kernel- and user-mode components, encrypted storage, plugin-based extensibility, process injection, audit-log suppression, passive network backdoors, and capabilities including file theft, screenshots, keylogging, browser monitoring, removable-media surveillance, and even **HDD/SSD firmware manipulation**. Investigators also linked the Solaris tooling to command-and-control infrastructure, including the domain **`xxxech.com`** and an IP address in the same subnet as Windows-related infrastructure, reinforcing the assessment that Equation Group maintained a sophisticated, multi-platform cyberespionage capability.
Aug 15, 2026
Kaspersky published an investigation report on a September 2014 incident in which **Equation malware** was detected on systems in the United States, revisiting one of the most closely watched nation-state malware cases tied to the highly sophisticated Equation threat actor. The report documents the circumstances of the detection and the handling of the malware sample, adding detail to a case that drew scrutiny because Equation has long been associated with advanced cyber-espionage capabilities and stealthy post-compromise tooling. The disclosure highlights how a single malware detection can trigger broader concerns about attribution, sample handling, and the exposure of sensitive offensive cyber capabilities. By formally documenting the incident years later, Kaspersky provided additional context for defenders tracking legacy intrusions, advanced implants, and the operational risks posed when elite malware frameworks are discovered on victim networks or transferred beyond their original operators.
Jul 12, 2026