Loading story…
Public research and reverse-engineering efforts exposed the architecture and capabilities of DanderSpritz, the Equation Group post-exploitation framework leaked by the Shadow Brokers. A GitHub documentation project cataloged decompiled Python components and resource files, mapping internal module names to functions including packet capture, memory dumping, keylogging, persistence, credential theft, SQL and Oracle database access, and remote command execution. The material also linked the framework to associated implants and components such as DarkPulsar, DoubleFeature, DoormanGauze, PeddleCheap, and ZippyBang.
Check Point Research later expanded that picture with a deep technical analysis of DoubleFeature, a DanderSpritz logging plugin that revealed how the broader platform handled plugins, command execution, and collection. The researchers described an encrypted log file, a kernel driver named hidsvc.sys loaded via the EpMe exploit for CVE-2017-0005, and rootkit functionality that could invoke kernel APIs through IOCTLs while evading forensic tools. Their work also surfaced forensic artifacts and operational details tied to other Equation Group tools, including UnitedRake, StraitBizarre, KillSuit, DiveBar, FlewAvenue, MistyVeal, DiceDealer, and PeddleCheap.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Check Point Research published a technical analysis of the DoubleFeature plugin within DanderSpritz, detailing its logging architecture, encrypted report handling, and use of the hidsvc.sys driver loaded via the EpMe exploit for CVE-2017-0005. The report also documented indicators and functionality tied to multiple Equation Group tools monitored by DoubleFeature.
A public GitHub repository, DanderSpritz_docs, was published to document and reverse engineer modules from the leaked DanderSpritz framework. The project shared decompiled Python code and resource files from the leak while noting it did not include the full FuzzBunch code, exploits, or runnable binaries.
The Shadow Brokers leaked the Equation Group's DanderSpritz post-exploitation framework as part of the Lost in Translation release. This leak exposed the framework's directory structure, plugins, and components later analyzed by researchers.
Check Point Research states that the Jian exploit was observed in the wild as early as 2014, predating the Shadow Brokers disclosures by about two years. The researchers assess this early use was likely an exception rather than evidence of broad prior access to Equation Group tools.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
epicturla.com
Open sourceresearch.checkpoint.com
Open sourcegithub.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Equation Group** operated a highly modular espionage platform across **Windows, Linux, and Solaris/SPARC**, extending the reach of its long-running **EquationDrug** toolset beyond previously documented Windows infections. Analysis identified a **Linux x86 DoubleFantasy** implant used for target validation and reconnaissance, alongside **Solaris SPARC** components including a rootkit and a Solaris **DoubleFantasy** module for persistence, host profiling, concealment, and remote command execution. The Solaris malware was described as capable of hiding files, processes, and services, installing startup scripts, generating hidden directories from host-specific values, and decrypting embedded payloads for execution. The findings tie the non-Windows implants to the broader EquationDrug ecosystem through shared custom encryption logic and the same **16-byte key material** previously associated with Windows **DoubleFantasy** communications and registry encryption. Separate analysis of EquationDrug described a mature espionage framework with kernel- and user-mode components, encrypted storage, plugin-based extensibility, process injection, audit-log suppression, passive network backdoors, and capabilities including file theft, screenshots, keylogging, browser monitoring, removable-media surveillance, and even **HDD/SSD firmware manipulation**. Investigators also linked the Solaris tooling to command-and-control infrastructure, including the domain **`xxxech.com`** and an IP address in the same subnet as Windows-related infrastructure, reinforcing the assessment that Equation Group maintained a sophisticated, multi-platform cyberespionage capability.
Aug 15, 2026
Kaspersky detailed **EquationDrug** as the main long-running espionage platform used by the **Equation Group**, describing it as a highly sophisticated modular framework rather than a single Trojan. The malware family was tied to computer network exploitation activity dating back to at least 2001, and possibly earlier, with architecture and development artifacts indicating a disciplined, English-speaking team. Researchers said the platform combined kernel-mode and user-mode components with an orchestrator, encrypted storage, and dozens of selectively deployed plugins tailored to individual victims. The framework supported broad surveillance and intrusion functions, including file theft, screenshots, network interception, browser monitoring, keylogging, removable-media monitoring, NTFS forensics, passive network backdoors, and even HDD/SSD firmware manipulation. Kaspersky identified 30 plugin IDs and a wider ecosystem of supporting components such as `msndsrv.sys`, `mscfg32.exe`, `mscfg32.dll`, `tdip.sys`, `mstcp32.sys`, `msrtvd.sys`, `volrec.sys`, and `nls_933w.dll`, which were used for stealth, persistence, traffic filtering, audit-log suppression, and covert command execution. The report said EquationDrug was later superseded by the more advanced **GrayFish** platform.
Jun 29, 2026
Kaspersky reported that the tools released by **ShadowBrokers** bear strong technical hallmarks of the **Equation Group**, tying the leaked firewall exploits, scripts, and operational tooling to one of the most sophisticated known cyber-espionage arsenals. The strongest evidence came from a rare `RC5/RC6` cryptographic implementation previously seen only in Equation malware, including the unusual use of the constant `0x61C88647` in a subtraction-based routine. Researchers found **347** `RC5/RC6` instances in the leaked archive, with more than **300 files** using that specific `RC6` variant across **24** forms, reinforcing the attribution with high confidence. The free archive released by ShadowBrokers contained roughly **300MB** of material, mostly timestamped from **August to October 2013**, and some researchers said they were able to successfully test certain exploits, indicating that at least part of the leaked toolkit was operational and authentic.
Jun 29, 2026