Close
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Artificial Intelligence
  • Video
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity

    ‘Equation’ Cyber-Espionage Group Likely Tied to NSA, Kaspersky Says

    Written by

    Robert Lemos
    Published February 18, 2015
    Share
    Facebook
    Twitter
    Linkedin

      eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

      An espionage group has infected thousands—and possibly tens of thousands—of targets globally using sophisticated malware that has telltale links to code previously attributed to operations carried out by the National Security Agency, according to a Feb. 16 report by Kaspersky Lab.

      Dubbed “Equation” by Kaspersky researchers, the group has operated for at least 15 years, targeting governments and a variety of critical industries, including oil and gas, military contractors, telecommunications and nuclear research. The surveillance effort has also focused on cryptographers and Islamic scholars, Kaspersky researchers said.

      In total, the company observed more than 500 infections, but estimates that there could easily be more than 10,000 systems compromised over the last 15 years or so.

      “A lot of infections have been observed on servers, often domain controllers, data warehouses, website hosting and other types of servers,” the researchers stated in their report. “At the same time, the infections have a self-destruct mechanism, so we can assume there were probably tens of thousands of infections around the world throughout the history of the Equation group’s operations.”

      The malware is the latest espionage network apparently linked to a nation-state. Previous research by Symantec, Kaspersky and other security firms unveiled details of another sophisticated operation known as Regin, with links to both British and American intelligence agencies. Two years ago, Kaspersky also revealed technical details of a large espionage network that appeared to have Russian and Chinese origins.

      The Equation group appears to have technical connections to Stuxnet. Both use a program, called “Fanny,” to infect USB drives and use the popular memory sticks as a way to communicate and spread infection. In addition, some keywords in the program match codenames of NSA programs leaked by former contractor Edward Snowden.

      Kaspersky named the group “Equation” for its penchant for complex encryption algorithms and obfuscation. The group targeted more than 30 countries, with a focus on Iran, Russia, Pakistan, Afghanistan, India and China.

      The Equation group used a number of modules to reconnoiter and infect systems. DoubleFantasy is a module or “implant” that establishes a backdoor inside the system, validating that the compromised machine is interesting to the attackers. It then installs additional software, such as EquationDrug or GrayFish.

      EquationDrug gives the attackers full control over the compromised system, using 35 different plugins. Because EquationDrug is not a signed binary, it will be detected on many modern operating systems and the Equation group apparently ceased using it in 2013, according to Kaspersky Lab. In its place, another implant platform, known as GrayFish, had been installed.

      GrayFish is a “highly sophisticated” set of programs, which hijacks the loading of the operating system, uses encrypted modules and self- destructs if an error occurs. The GrayFish malware platform includes a module that can rewrite the firmware of the hard drive, giving the program complete control of the computer soon after the machine is turned on, Kaspersky researchers said. Information about the NSA implant’s capability to rewrite firmware, known under the codename “IrateMonk,” was leaked in the Snowden documents.

      “From all indications this is very advanced malware that can infect hard drive firmware,” Lamar Bailey, director of security R&D at security firm Tripwire, said in a statement. “Infected firmware from the factory or persuading users to upgrade to an infected firmware is not uncommon but infecting firmware silently in place is much more dangerous.”

      While all the malware detected by Kaspersky Lab focused on the Windows operating system, there are signs that some versions of the DoubleFantasy payload infected Mac OS X 10.8, while other software infected iPhones.

      Robert Lemos
      Robert Lemos
      Robert Lemos is an award-winning journalist who has covered information security, cybercrime and technology's impact on society for almost two decades. A former research engineer, he's written for Ars Technica, CNET, eWEEK, MIT Technology Review, Threatpost and ZDNet. He won the prestigious Sigma Delta Chi award from the Society of Professional Journalists in 2003 for his coverage of the Blaster worm and its impact, and the SANS Institute's Top Cybersecurity Journalists in 2010 and 2014.

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      Get the Free Newsletter!

      Subscribe to Daily Tech Insider for top news, trends & analysis

      MOST POPULAR ARTICLES

      Artificial Intelligence

      9 Best AI 3D Generators You Need...

      Sam Rinko - June 25, 2024 0
      AI 3D Generators are powerful tools for many different industries. Discover the best AI 3D Generators, and learn which is best for your specific use case.
      Read more
      Cloud

      RingCentral Expands Its Collaboration Platform

      Zeus Kerravala - November 22, 2023 0
      RingCentral adds AI-enabled contact center and hybrid event products to its suite of collaboration services.
      Read more
      Artificial Intelligence

      8 Best AI Data Analytics Software &...

      Aminu Abdullahi - January 18, 2024 0
      Learn the top AI data analytics software to use. Compare AI data analytics solutions & features to make the best choice for your business.
      Read more
      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Video

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2024 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×