Ajay Kumar: Created a new article

2023-09-25T18:40:51Z

Created a new article

New page

{{short description|Cyber attack group}}
{{Infobox organization
| name = Equation Group
| named_after =
| image =
| image_size =
| alt =
| caption =
| logo =
| logo_size =
| logo_alt =
| logo_caption =
| abbreviation =
| motto =
| predecessor =
| merged =
| successor =
| formation = 
| founder =
| founding_location =
| extinction = 
| merger =
| type = [[Advanced persistent threat]]
| status =
| purpose =
| headquarters =
| location = [[United States]]
| coords = 
| region =
| services =
| products = [[Stuxnet]], [[Flame (malware)|Flame]], [[EternalBlue]]
| methods =
| fields =
| sec_gen =
| key_people =
| main_organ =
| parent_organization =
* [[National Security Agency]]
** [[Signals Intelligence Directorate]]
*** [[Tailored Access Operations]]
| subsidiaries =
| secessions =
| affiliations =
| staff =
| staff_year =
| volunteers =
| volunteers_year =
| formerly =
| footnotes =
}}

The '''Equation Group''', classified as an [[advanced persistent threat]], is a highly sophisticated [[Threat (computer)#Threat agents or actors|threat actor]] suspected of being tied to the [[Tailored Access Operations]] (TAO) unit of the [[United States]] [[National Security Agency]] (NSA).<ref>{{cite journal|last=Fox-Brewster|first=Thomas|date=February 16, 2015|title=Equation = NSA? Researchers Uncloak Huge 'American Cyber Arsenal' |url=https://www.forbes.com/sites/thomasbrewster/2015/02/16/nsa-equation-cyber-tool-treasure-chest/|journal=[[Forbes]] |access-date=November 24, 2015}}</ref><ref>{{cite news|url=https://www.reuters.com/article/idUSL1N0VN15J20150216|title=Russian researchers expose breakthrough U.S. spying program|last=Menn|first=Joseph|date=February 17, 2015 |publisher=[[Reuters]]|access-date=November 24, 2015}}</ref><ref>{{cite news|title=The nsa was hacked snowden documents confirm|work=[[The Intercept]]|url=https://theintercept.com/2016/08/19/the-nsa-was-hacked-snowden-documents-confirm/|date=19 August 2016|access-date=19 August 2016}}</ref> [[Kaspersky Labs]] describes them as one of the most sophisticated cyber attack groups in the world and "the most advanced (...) we have seen", operating alongside the creators of [[Stuxnet]] and [[Flame (malware)|Flame]].<ref name="malware-galaxy">{{cite web |url=https://securelist.com/equation-the-death-star-of-malware-galaxy/68750/ |title=Equation: The Death Star of Malware Galaxy |author=GReAT |date=February 16, 2015 |website=Securelist.com |publisher=[[Kaspersky Lab]] |access-date=August 16, 2016 |quote=''SecureList'', Costin Raiu (director of Kaspersky Lab's global research and analysis team): "It seems to me Equation Group are the ones with the coolest toys. Every now and then they share them with the Stuxnet group and the Flame group, but they are originally available only to the Equation Group people. Equation Group are definitely the masters, and they are giving the others, maybe, bread crumbs. From time to time they are giving them some goodies to integrate into Stuxnet and Flame."}}</ref><ref name=ars/> Most of their targets have been in [[Iran]], [[Russia]], [[Pakistan]], [[Afghanistan]], [[India]], [[Syria]] and [[Mali]].<ref name="ars" />

The name originated from the group's extensive use of encryption. By 2015, Kaspersky documented 500 [[malware]] infections by the group in at least 42 countries, while acknowledging that the actual number could be in the tens of thousands due to its self-terminating protocol.<ref name=ars>{{cite news |title=How "omnipotent" hackers tied to NSA hid for 14 years—and were found at last |work=[[Ars Technica]] |url=https://arstechnica.com/security/2015/02/how-omnipotent-hackers-tied-to-the-nsa-hid-for-14-years-and-were-found-at-last/ |first=Dan |last=Goodin |date=February 16, 2015 |access-date=November 24, 2015}}</ref><ref>{{cite web|url=http://www.pcworld.com/article/2884952/equation-cyberspies-use-unrivaled-nsastyle-techniques-to-hit-iran-russia.html |title=Destroying your hard drive is the only way to stop this super-advanced malware |first=Jeremy |last=Kirk |date=17 February 2015 |work=[[PCWorld]] |access-date=November 24, 2015}}</ref>

In 2017, WikiLeaks [[Vault 7|published a discussion]] held within the [[Central Intelligence Agency|CIA]] on how it had been possible to identify the group.<ref name="Goodin CIA">{{cite web|last1=Goodin|first1=Dan|title=After NSA hacking exposé, CIA staffers asked where Equation Group went wrong|url=https://arstechnica.com/security/2017/03/after-nsa-hacking-expose-cia-staffers-asked-where-equation-group-went-wrong/|website=[[Ars Technica]]|date=7 March 2017|access-date=21 March 2017}}</ref> One commenter wrote that "the Equation Group as labeled in the report does not relate to a specific group but rather a collection of tools" used for hacking.<ref name="What did Equation do wrong">{{cite web |title=What did Equation do wrong, and how can we avoid doing the same?|url=https://wikileaks.org/ciav7p1/cms/page_14588809.html |website=Vault 7|publisher=[[WikiLeaks]]|access-date=21 March 2017}}</ref>

==Discovery==
At the Kaspersky Security Analysts Summit held in Mexico on February 16, 2015, Kaspersky Lab announced its discovery of the Equation Group. According to Kaspersky Lab's report, the group has been active since at least 2001, with more than 60 actors.<ref name="kaspersky">{{Cite web |title=Equation Group: The Crown Creator of Cyber-Espionage |work=Kaspersky Lab |url=http://www.kaspersky.com/about/news/virus/2015/Equation-Group-The-Crown-Creator-of-Cyber-Espionage |date=February 16, 2015 |access-date=November 24, 2015}}</ref> The malware used in their operations, dubbed EquationDrug and GrayFish, is found to be capable of reprogramming [[hard disk drive]] [[firmware]].<ref name="malware-galaxy"/> Because of the advanced techniques involved and high degree of covertness, the group is suspected of ties to the NSA, but Kaspersky Lab has not identified the actors behind the group.

==Probable links to Stuxnet and the NSA==
In 2015 Kaspersky's research findings on the Equation Group noted that its loader, "Grayfish", had similarities to a previously discovered loader, "Gauss",{{Plain link|https://github.com/loneicewolf/Gauss-Src|<sup><nowiki>[repository]</nowiki></sup>}} from another attack series, and separately noted that the Equation Group used two zero-day attacks later used in [[Stuxnet]]; the researchers concluded that "the similar type of usage of both exploits together in different computer worms, at around the same time, indicates that the EQUATION group and the Stuxnet developers are either the same or working closely together".<ref name="Kaspersky1">{{cite web |url=https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf |title=Equation Group: Questions and Answers (Version: 1.5) |date=February 2015 |publisher=[[Kaspersky Lab]] |access-date=November 24, 2015 |archive-url=https://web.archive.org/web/20150217023145/https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf |archive-date=February 17, 2015 |url-status=dead }}</ref>{{rp|13}}

===Firmware===
They also identified that the platform had at times been spread by [[interdiction]] (interception of legitimate CDs sent by a scientific conference organizer by [[mail]]),<ref name="Kaspersky1" />{{rp|15}} and that the platform had the "unprecedented" ability to infect and be transmitted through the [[hard drive]] [[firmware]] of several major hard drive manufacturers, and create and use hidden disk areas and virtual disk systems for its purposes, a feat which would require access to the manufacturer's [[source code]] to achieve,<ref name="Kaspersky1" />{{rp|16–18}} and that the tool was designed for surgical precision, going so far as to exclude specific countries by IP and allow targeting of specific usernames on [[discussion forum]]s.<ref name="Kaspersky1"/>{{rp|23–26}}

===Codewords and timestamps===
The NSA codewords  "STRAITACID" and "STRAITSHOOTER" have been found inside the malware. In addition, [[timestamps]] in the malware seem to indicate that the programmers worked overwhelmingly Monday–Friday in what would correspond to a 08:00–17:00 (8:00 AM - 5:00 PM) workday in an Eastern United States time zone.<ref>{{cite web |url=https://arstechnica.com/security/2015/03/new-smoking-gun-further-ties-nsa-to-omnipotent-equation-group-hackers/ |title=New smoking gun further ties NSA to omnipotent "Equation Group" hackers |first=Dan |last=Goodin |date=March 11, 2015 |work=Ars Technica |access-date=November 24, 2015}}</ref>

===The LNK exploit===
Kaspersky's global research and analysis team, otherwise known as GReAT, claimed to have found a piece of malware that contained Stuxnet's "privLib" in 2008.<ref>{{cite web |url=https://securelist.com/blog/research/68787/a-fanny-equation-i-am-your-father-stuxnet/|title=A Fanny Equation: "I am your father, Stuxnet" |publisher=Kaspersky Lab |date=February 17, 2015 |access-date=November 24, 2015}}</ref> Specifically it contained the LNK exploit found in Stuxnet in 2010. Fanny is classified as a worm that affects certain [[Microsoft Windows|Windows operating systems]] and attempts to spread laterally via network connection or [[Universal Serial Bus|USB storage]].{{Plain link|https://github.com/loneicewolf/fanny.bmp|<sup><nowiki>[repository]</nowiki></sup>}} Kaspersky stated that they suspect that the Equation Group has been around longer than Stuxnet, based on the recorded compile time of Fanny.<ref name="malware-galaxy"/>

===Link to IRATEMONK===
[[File:NSA IRATEMONK.jpg|thumb|The NSA's listing of its [[Tailored Access Operations]] program named IRATEMONK from the [[NSA ANT catalog]].]]
[[F-Secure]] claims that the Equation Group's malicious hard drive [[firmware]] is [[Tailored Access Operations|TAO]] program "IRATEMONK",<ref name="FSecure">{{cite web|url=https://www.f-secure.com/weblog/archives/00002791.html |title=The Equation Group Equals NSA / IRATEMONK |work=[[F-Secure]] Weblog : News from the Lab |date=February 17, 2015 |access-date=November 24, 2015}}</ref> one of the items from the [[NSA ANT catalog]] exposed in a 2013 ''Der Spiegel'' article. IRATEMONK provides the attacker with an ability to have their [[Application software|software application]] persistently installed on desktop and laptop computers, despite the disk being [[Disk formatting|formatted]], its [[Data erasure|data erased]] or the operating system re-installed. It infects the hard drive firmware, which in turn adds instructions to the disk's [[master boot record]] that causes the software to install each time the computer is [[Booting|booted up]].<ref name="IRATEMONK"/> It is capable of infecting certain hard drives from [[Seagate Technology|Seagate]], [[Maxtor]], [[Western Digital]], [[Samsung]],<ref name="IRATEMONK">{{cite web |url=https://www.schneier.com/blog/archives/2014/01/iratemonk_nsa_e.html |first=Bruce |last=Schneier |title=IRATEMONK: NSA Exploit of the Day |work=Schneier on Security |date=January 31, 2014 |access-date=November 24, 2015}}</ref> [[IBM]], [[Micron Technology]] and [[Toshiba]].<ref name="malware-galaxy" />

==2016 breach of the Equation Group==
In August 2016, a hacking group calling itself "[[The Shadow Brokers]]" announced that it had stolen malware code from the Equation Group.<ref>{{cite news |url=https://arstechnica.com/security/2016/08/group-claims-to-hack-nsa-tied-hackers-posts-exploits-as-proof/ |first=Dan |last=Goodin |title=Group claims to hack NSA-tied hackers, posts exploits as proof |date=August 15, 2016 |access-date=August 19, 2016 |newspaper=Ars Technica}}</ref> Kaspersky Lab noticed similarities between the stolen code and earlier known code from the Equation Group malware samples it had in its possession including quirks unique to the Equation Group's way of implementing the [[RC6]] encryption algorithm, and therefore concluded that this announcement is legitimate.<ref>{{cite news |url=https://arstechnica.com/security/2016/08/code-dumped-online-came-from-omnipotent-nsa-tied-hacking-group/ |title=Confirmed: hacking tool leak came from "omnipotent" NSA-tied group |first=Dan |last=Goodin |date=August 16, 2016 |access-date=August 19, 2016 |newspaper=Ars Technica}}</ref> The most recent dates of the stolen files are from June 2013, thus prompting [[Edward Snowden]] to speculate that a likely lockdown resulting from his leak of the [[Global surveillance disclosures (2013–present)|NSA's global and domestic surveillance efforts]] stopped The Shadow Brokers' breach of the Equation Group. Exploits against [[Cisco Adaptive Security Appliance]]s and [[Fortinet]]'s firewalls were featured in some malware samples released by The Shadow Brokers.<ref name="EXTRABACON">{{cite news |url=https://www.theregister.co.uk/2016/08/17/cisco_two_shadow_brokers_vulnerabilities_real/ |first=Iain |last=Thomson |title=Cisco confirms two of the Shadow Brokers' 'NSA' vulns are real |date=August 17, 2016 |access-date=August 19, 2016 |newspaper=[[The Register]]}}</ref> EXTRABACON, a [[Simple Network Management Protocol]] exploit against Cisco's ASA software, was a [[Zero-day (computing)|zero-day exploit]] as of the time of the announcement.<ref name="EXTRABACON"/> Juniper also confirmed that its NetScreen firewalls were affected.<ref>{{cite news |title=Equation Group exploit hits newer Cisco ASA, Juniper Netscreen |url=https://www.theregister.co.uk/2016/08/24/equation_group_exploit_expanded_to_target_cisco_924_asa_boxes/ |first=Darren |last=Pauli |date=August 24, 2016 |access-date=August 30, 2016 |newspaper=[[The Register]]}}</ref> The [[EternalBlue]] exploit was used to conduct the damaging worldwide [[WannaCry ransomware attack]].

==See also==
* [[Global surveillance disclosures (2013–present)]]
* [[United States intelligence operations abroad]]
* [[Firmware#Firmware hacking|Firmware hacking]]

==References==
{{reflist|30em}}

==External links==

* ''[https://web.archive.org/web/20150217023145/https://securelist.com/files/2015/02/Equation_group_questions_and_answers.pdf Equation Group: Questions and Answers]'' by [[Kaspersky Lab]], Version: 1.5, February 2015
* [https://securelist.com/blog/research/68787/a-fanny-equation-i-am-your-father-stuxnet/ A Fanny Equation: "I am your father, Stuxnet"] by [[Kaspersky Lab]], February 2015

* [https://github.com/loneicewolf/fanny.bmp fanny.bmp source - at GitHub], November 30, 2020

* [https://github.com/loneicewolf/fanny.bmp/blob/main/Reports/Fanny.BMP(DementiaWheel)_Technical_Report_By_WilliamMartens-2021-10Feb.pdf Technical Write-up - at GitHub], February 10, 2021

{{Hacking in the 2010s}}
[[Category:Cyberwarfare in the United States]]
[[Category:National Security Agency operations]]
[[Category:Rootkits]]
[[Category:American advanced persistent threat groups]]
[[Category:Cybercrime in India]]
[[Category:Cyberwarfare in Iran]]

Equation Group - Revision history

Ajay Kumar: Created a new article