Equation Group

Summary

Cyber-espionage actor that Kaspersky exposed in 2015 and described as probably one of the most sophisticated cyber attack groups in the world. From computer-network-exploitation operations dating back to 2001, Kaspersky counted more than 500 victims in more than 30 countries — and, because its implants self-destruct, probably tens of thousands of infections in all. Its platforms (EQUATIONLASER, EQUATIONDRUG, DOUBLEFANTASY, TRIPLEFANTASY, GRAYFISH, FANNY) include hard-drive firmware reprogramming that survives disk formatting and OS reinstall, an encrypted virtual file system in the registry, and a USB-based command channel for air-gapped networks. Infection came through the Fanny worm, interdicted CD-ROMs, USB sticks with exploits, and web exploits served to visitors of compromised forums and Middle East ad networks. Fanny used two zero-days later seen in Stuxnet, and Kaspersky judged it 'quite possible' that Equation malware delivered the Stuxnet payload; it describes the Stuxnet and Flame groups as separate groups Equation 'interacted with'. Kaspersky found with high confidence that tools in the Shadow Brokers' 2016 leak are related to Equation malware; Symantec calls the 2017 releases, including the EternalBlue exploit later used in WannaCry, Equation Group tools. Pangu Lab (2022) attributed the Bvp47 Linux backdoor to it using a private key found in the Shadow Brokers leaks. PRC and Russian government allegations (claimed, not independently corroborated): China's CVERC/Qihoo 360 attributed the 2022 Northwestern Polytechnical University intrusion to NSA TAO (Qihoo: APT-C-40); CVERC/360 alleged a US backdoor at the Wuhan Earthquake Monitoring Center (2023); CNCERT alleged US intrusions into Chinese research, energy and defence enterprises (2023–2024); Harbin police named three alleged NSA operatives over the 2025 Asian Winter Games; the MSS alleged a 2022–2024 NSA campaign against the National Time Service Center. Russia's FSB blamed the NSA for Operation Triangulation (2023), which Kaspersky did not attribute. Most PRC claims name 'US intelligence' rather than a unit and are recorded here as claimed campaigns; they do not change last_seen.

Attribution

Never confirmed by the US government

Hedged, circumstantial or press-only reporting; not established.

• Reuters (via Bangor Daily News) (Press, 2015-02-16)
  A former NSA employee confirmed the analysis; Kaspersky named no country
• Kaspersky GReAT (Research, 2015-02-16)
  Interacted with the Stuxnet and Flame groups
• SecurityWeek (Claim, 2025-02-21)
  PRC CVERC accuses the NSA (adversary-government claim)

MITRE ATT&CK techniques 12

Exploited vulnerabilities 4

Highest CVSS first.

Infrastructure patterns

• C&C on 300+ domains and 100+ servers in the US, UK, Italy, Germany, Netherlands, Panama and others (Kaspersky, 2015)
• Fanny's USB-based C&C runs commands inside air-gapped networks (Kaspersky, 2015)