Loading story…
Researchers reported that the Equation Group operated a highly modular espionage platform across Windows, Linux, and Solaris/SPARC, extending the reach of its long-running EquationDrug toolset beyond previously documented Windows infections. Analysis identified a Linux x86 DoubleFantasy implant used for target validation and reconnaissance, alongside Solaris SPARC components including a rootkit and a Solaris DoubleFantasy module for persistence, host profiling, concealment, and remote command execution. The Solaris malware was described as capable of hiding files, processes, and services, installing startup scripts, generating hidden directories from host-specific values, and decrypting embedded payloads for execution.
The findings tie the non-Windows implants to the broader EquationDrug ecosystem through shared custom encryption logic and the same 16-byte key material previously associated with Windows DoubleFantasy communications and registry encryption. Separate analysis of EquationDrug described a mature espionage framework with kernel- and user-mode components, encrypted storage, plugin-based extensibility, process injection, audit-log suppression, passive network backdoors, and capabilities including file theft, screenshots, keylogging, browser monitoring, removable-media surveillance, and even HDD/SSD firmware manipulation. Investigators also linked the Solaris tooling to command-and-control infrastructure, including the domain xxxech.com and an IP address in the same subnet as Windows-related infrastructure, reinforcing the assessment that Equation Group maintained a sophisticated, multi-platform cyberespionage capability.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
In November 2016, Antiy published a report analyzing Equation Group malware for Linux and Solaris/SPARC, arguing it demonstrated multi-platform capability beyond Windows. The report said this was the first proof of Equation malware on those platforms and linked the Linux and Solaris samples to previously known Windows DoubleFantasy encryption material and infrastructure.
On March 12, 2015, Securelist published a detailed analysis of the EquationDrug espionage platform, describing its modular architecture, stealth features, and long-running use by the Equation Group.
Securelist says EquationDrug dates back to 2003 and became one of the Equation Group's main espionage platforms, replacing the earlier EquationLaser framework.
Securelist reports that Equation Group operations date back to 2001, establishing a confirmed early period for the threat actor's activity.
Kaspersky's analysis states the Equation Group's computer network exploitation activity may date back to 1996, indicating very early development of the actor's capabilities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky detailed **EquationDrug** as the main long-running espionage platform used by the **Equation Group**, describing it as a highly sophisticated modular framework rather than a single Trojan. The malware family was tied to computer network exploitation activity dating back to at least 2001, and possibly earlier, with architecture and development artifacts indicating a disciplined, English-speaking team. Researchers said the platform combined kernel-mode and user-mode components with an orchestrator, encrypted storage, and dozens of selectively deployed plugins tailored to individual victims. The framework supported broad surveillance and intrusion functions, including file theft, screenshots, network interception, browser monitoring, keylogging, removable-media monitoring, NTFS forensics, passive network backdoors, and even HDD/SSD firmware manipulation. Kaspersky identified 30 plugin IDs and a wider ecosystem of supporting components such as `msndsrv.sys`, `mscfg32.exe`, `mscfg32.dll`, `tdip.sys`, `mstcp32.sys`, `msrtvd.sys`, `volrec.sys`, and `nls_933w.dll`, which were used for stealth, persistence, traffic filtering, audit-log suppression, and covert command execution. The report said EquationDrug was later superseded by the more advanced **GrayFish** platform.
Jun 29, 2026
Kaspersky detailed a highly sophisticated cyber-espionage operation attributed to the **Equation Group**, describing a malware ecosystem with multiple toolsets, covert command-and-control methods, and the ability to maintain long-term access on victim networks. The report linked the group to a broad range of implants and frameworks used for surveillance, data theft, and lateral movement, and said its tradecraft ranked among the most advanced seen publicly at the time. A standout finding was the group’s apparent ability to reprogram hard drive firmware from major manufacturers, giving attackers persistence that could survive disk formatting, reinstallation, and operating system replacement. Researchers said the platform also used stealth techniques such as encrypted virtual file systems, hidden storage areas, and modular malware components, underscoring the risk posed by state-grade operators capable of embedding malicious functionality deep below the operating system layer.
Jul 12, 2026
Public research and reverse-engineering efforts exposed the architecture and capabilities of **DanderSpritz**, the Equation Group post-exploitation framework leaked by the Shadow Brokers. A GitHub documentation project cataloged decompiled Python components and resource files, mapping internal module names to functions including packet capture, memory dumping, keylogging, persistence, credential theft, SQL and Oracle database access, and remote command execution. The material also linked the framework to associated implants and components such as **DarkPulsar**, **DoubleFeature**, **DoormanGauze**, **PeddleCheap**, and **ZippyBang**. Check Point Research later expanded that picture with a deep technical analysis of **DoubleFeature**, a DanderSpritz logging plugin that revealed how the broader platform handled plugins, command execution, and collection. The researchers described an encrypted log file, a kernel driver named `hidsvc.sys` loaded via the **EpMe** exploit for **`CVE-2017-0005`**, and rootkit functionality that could invoke kernel APIs through IOCTLs while evading forensic tools. Their work also surfaced forensic artifacts and operational details tied to other Equation Group tools, including **UnitedRake**, **StraitBizarre**, **KillSuit**, **DiveBar**, **FlewAvenue**, **MistyVeal**, **DiceDealer**, and **PeddleCheap**.
Aug 15, 2026