Equation

Overview

Equation is a sophisticated threat group that employs multiple remote access tools. The group is known to use zero-day exploits and has developed the capability to overwrite the firmware of hard disk drives.

Naming & attribution

Equation is tracked under 1 names across the industry. It uses 4 documented ATT&CK techniques — more than 9% of the 174 groups tracked here.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1542.002 Component Firmware — used by 1 of 174 groups
• T1480.001 Environmental Keying — used by 2 of 174 groups
• T1564.005 Hidden File System — used by 2 of 174 groups

TTPs — 4 techniques across 2 tactics

Reporting (1)

• Equation Group: Questions and Answers — Kaspersky Lab's Global Research and Analysis Team