Equation GroupThreat actor
- eqgrp
- g0020
- tilded team
The Equation Group is a highly sophisticated threat actor described by its discoverers at Kaspersky Labs as one of the most sophisticated cyber attack groups in the world, operating alongside but always from a position of superiority with the creators of Stuxnet and FlameFrom MISP Galaxy
Last reported 5 years ago, by Group-IB2 reports
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1014Rootkit
“In 2015, Corey Kallenberg and another researcher, Xeno Kovah, presented LightEater, a rootkit that allows to obtain critical data (encryption keys, etc.) through direct access to physical memory and page-by-page searches using signatures.”
- T1027Obfuscated Files or Information
“T1027 – Obfuscated Files or Information”
- T1105Ingress Tool Transfer
“T1105 – Ingress Tool Transfer”
- T1197BITS Jobs
“T1197 – BITS Jobs”
- T1542.001System Firmware
“T1542.001 – Pre-OS Boot: System Firmware”
- T1542.003Bootkit
“Let's hunt some bootkits”
What the reports say
2 reports, newest first · the exact sentence from each-
Masters of disguise“In the same year, the leak of Equation Group documents (allegedly associated with the US NSA) revealed the existence of the BANANABALLOT BIOS module, which deploys a certain implant to interact with CISCO routers.”
-
Targeted attacks on banks“When the Shadow Brokers group (for more details about their attacks, see the Forbes material) shared data from a leak from the Equation Group – hackers associated with the US National Security Agency, it became clear that the secret service probably had access to SWIFT and contro…”
Indicators in its reports
named in the reports above- 103.56.115[.]69in 1 report
- myfirewall[.]orgin 1 report
- f5b320f7e87cc6f9d02e28350bb87de6in 1 report
- dd8d3718197a10097cd72a94ed223238in 1 report
- 91a473d3711c28c3c563284dfafe926bin 1 report
- 0c136186858fd36080a7066657de81f5in 1 report
- 9f13636d5861066835ed5a79819aac28in 1 report
- fa0a874926453e452e3b6ced045d2206in 1 report
- 72c514c0b96e3a31f6f1a85d8f28403cin 1 report
- 0d386ebba1ccf1758a19fb0b25451afein 1 report
- b53880397d331c6fe3493a9ef81cd76ein 1 report
- 7b213a6ce7ab30a62e84d81d455b4deain 1 report
- a69205984849744c39cfb421d8e97b1fin 1 report
- 08ecd8068617c86d7e3a3e810b106dcein 1 report
- 89527f932188bd73572e2974f4344d46in 1 report
- 9e182d30b070bb14a8922cff4837b94din 1 report
- 61b4e0b1f14d93d7b176981964388291in 1 report
- 7908b9935479081a6e0f681ccef2fdd9in 1 report
- 3d2835c35ba789bd86620f98cbfbf08bin 1 report
- 1732357d3a0081a87d56ee1ae8b4d205in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.