Loading story…
Researchers disclosed new technical details on Bvp47, a stealthy Linux backdoor attributed to the Equation Group, after matching the malware’s RSA private key and framework components to material exposed in the Shadow Brokers leak. Pangu Lab said it originally recovered the implant during a 2013 forensic investigation into an intrusion it called Operation Telescreen, where attackers compromised internal servers and used an external relay host to pass commands, move payloads, and exfiltrate encrypted data. The malware used covert command-and-control over TCP SYN packets, obfuscation, and self-destruction features that helped it evade detection for more than a decade.
The disclosure adds to a broader body of reporting on the Equation Group as one of the most advanced cyber-espionage operators observed, with Kaspersky previously linking the actor to a large arsenal of implants, firmware-level persistence, USB-based operations against air-gapped networks, and overlap with the Stuxnet and Flame ecosystems. Reporting on the Shadow Brokers dump also showed the group’s tooling included Windows exploitation frameworks, SMB-focused capabilities, and PowerShell-based payload delivery, while code-level similarities between Bvp47 and other Equation-linked malware further reinforced the attribution. Pangu said Bvp47 was used against more than 287 organizations in 45 countries, including targets in telecom, military, education, economic, and scientific sectors.
TTPs, infrastructure, and targeting history in one profile.
18 events from the most recent confirmed update back to the earliest known activity.
Reporting on Pangu's disclosure said Kaspersky found code-level similarities between Bvp47 and an Equation-related Solaris sample, reinforcing the attribution to the Equation Group.
Pangu Lab publicly disclosed the covert Linux backdoor Bvp47, describing its TCP SYN covert channel, stealth features, and use against more than 287 targets in 45 countries, and attributed it to the Equation Group using overlaps with Shadow Brokers materials including the implant's RSA private key.
The Hacker News said Check Point Research disclosed another previously undocumented Equation Group utility named DoubleFeature in late December 2021.
Securelist published research linking Black, White, Blue, Green, Pink, and Gray Lambert through shared code, infrastructure, and victim overlap, outlining the toolkit's evolution.
Nettitude analyzed a Shadow Brokers dump released in April 2017 that exposed alleged NSA Equation Group Windows exploits and tooling including ZiPo and DAMAGEDGOODS.
Securelist said migration from White Lambert to Gray Lambert was still being seen in 2016, marking the latest known activity discussed for the toolkit.
Shadow Brokers leaked Equation Group exploit tools and related materials, later used by researchers to compare and attribute additional malware families.
Kaspersky Lab's GReAT announced discovery of the Equation Group, describing its advanced implant arsenal, hard-drive firmware persistence, air-gap tradecraft, and links to Stuxnet and Flame.
Securelist said FireEye publicly uncovered in October 2014 an in-the-wild attack using zero-day CVE-2014-4148, and Microsoft patched the flaw at disclosure time.
Securelist reported that an OS X variant of Green Lambert with codename HO BO and version 1.2.0 was uploaded to a multiscanner service from Russia in September 2014.
A high-profile organization in Europe was attacked in 2014 with Black Lambert using the Windows TrueType Font zero-day CVE-2014-4148.
BleepingComputer reported that a Bvp47 sample was first submitted to VirusTotal in late 2013 and initially drew detection from only one antivirus engine.
Nettitude's analysis of the Shadow Brokers dump said metadata on makedmgd.exe indicated a build date in July 2013, suggesting the leaked DAMAGEDGOODS tooling dated from that period if untampered.
Pangu Lab said it extracted the Bvp47 Linux backdoor during a forensic investigation of a host in a key domestic department, identifying an intrusion later codenamed Operation Telescreen.
Kaspersky reported that in 2008 the Equation Group's Fanny worm mapped air-gapped networks using a USB-based command-and-control mechanism and used two zero-days later seen in Stuxnet.
Securelist said the Lamberts, also known as Longhorn, had used sophisticated malware against high-profile victims since at least 2008 across Windows and OS X environments.
Kaspersky reported that the Equation Group had infected thousands to tens of thousands of victims across more than 30 countries since 2001, affecting government, telecom, aerospace, energy, military, finance, and other sectors.
After Pangu's report circulated in the infosec community, BleepingComputer said VirusTotal detections for the Bvp47 sample increased from one engine to six.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcebleepingcomputer.com
Open sourcesecurelist.com
Open sourcelabs.nettitude.com
Open sourcekaspersky.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that the tools released by **ShadowBrokers** bear strong technical hallmarks of the **Equation Group**, tying the leaked firewall exploits, scripts, and operational tooling to one of the most sophisticated known cyber-espionage arsenals. The strongest evidence came from a rare `RC5/RC6` cryptographic implementation previously seen only in Equation malware, including the unusual use of the constant `0x61C88647` in a subtraction-based routine. Researchers found **347** `RC5/RC6` instances in the leaked archive, with more than **300 files** using that specific `RC6` variant across **24** forms, reinforcing the attribution with high confidence. The free archive released by ShadowBrokers contained roughly **300MB** of material, mostly timestamped from **August to October 2013**, and some researchers said they were able to successfully test certain exploits, indicating that at least part of the leaked toolkit was operational and authentic.
Jun 29, 2026
Researchers reported that the **Equation Group** operated a highly modular espionage platform across **Windows, Linux, and Solaris/SPARC**, extending the reach of its long-running **EquationDrug** toolset beyond previously documented Windows infections. Analysis identified a **Linux x86 DoubleFantasy** implant used for target validation and reconnaissance, alongside **Solaris SPARC** components including a rootkit and a Solaris **DoubleFantasy** module for persistence, host profiling, concealment, and remote command execution. The Solaris malware was described as capable of hiding files, processes, and services, installing startup scripts, generating hidden directories from host-specific values, and decrypting embedded payloads for execution. The findings tie the non-Windows implants to the broader EquationDrug ecosystem through shared custom encryption logic and the same **16-byte key material** previously associated with Windows **DoubleFantasy** communications and registry encryption. Separate analysis of EquationDrug described a mature espionage framework with kernel- and user-mode components, encrypted storage, plugin-based extensibility, process injection, audit-log suppression, passive network backdoors, and capabilities including file theft, screenshots, keylogging, browser monitoring, removable-media surveillance, and even **HDD/SSD firmware manipulation**. Investigators also linked the Solaris tooling to command-and-control infrastructure, including the domain **`xxxech.com`** and an IP address in the same subnet as Windows-related infrastructure, reinforcing the assessment that Equation Group maintained a sophisticated, multi-platform cyberespionage capability.
Aug 15, 2026
Kaspersky detailed a highly sophisticated cyber-espionage operation attributed to the **Equation Group**, describing a malware ecosystem with multiple toolsets, covert command-and-control methods, and the ability to maintain long-term access on victim networks. The report linked the group to a broad range of implants and frameworks used for surveillance, data theft, and lateral movement, and said its tradecraft ranked among the most advanced seen publicly at the time. A standout finding was the group’s apparent ability to reprogram hard drive firmware from major manufacturers, giving attackers persistence that could survive disk formatting, reinstallation, and operating system replacement. Researchers said the platform also used stealth techniques such as encrypted virtual file systems, hidden storage areas, and modular malware components, underscoring the risk posed by state-grade operators capable of embedding malicious functionality deep below the operating system layer.
Jul 12, 2026