{
  "family": "equationdrug",
  "sample_count": 25,
  "category": "advanced_threat",
  "description": "Trojan:Win32/EquationDrug is a state-of-the-art cyber-espionage platform attributed by global threat intelligence researchers to the Equation Group (associated with US NSA Tailored Access Operations). First publicly documented by Kaspersky Lab's Global Research and Analysis Team (GReAT) in February 2015, EquationDrug operated actively from 2010 through 2013 as the direct operational predecessor to the GrayFish platform. EquationDrug represents one of the most sophisticated modular cyber-espionage frameworks ever uncovered, featuring a custom kernel-mode rootkit architecture, an encrypted virtual file system (VFS) hidden within Windows Registry hives, and over 116 dynamic plugin modules. The malware includes specialized modules for reprogramming hard disk drive firmware across more than a dozen major HDD manufacturing architectures (including Western Digital, Seagate, Maxtor, and Toshiba), creating persistent forensic-resistant sectors. EquationDrug utilized zero-day exploits including CVE-2010-2568 (LNK shortcut vulnerability, also utilized in Stuxnet) and CVE-2013-3881 (win32k.sys privilege escalation). The platform performed targeted surveillance against aerospace, nuclear research, military, and telecommunications organizations across Iran, Russia, Pakistan, Afghanistan, and Syria.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "EquationDrug",
    "Trojan.EquationDrug",
    "Win32/EquationDrug"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is EquationDrug?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "EquationDrug is a modular, kernel-level cyber-espionage framework developed by the Equation Group that provided covert surveillance, registry-based virtual file systems, and hard drive firmware manipulation."
      }
    },
    {
      "@type": "Question",
      "name": "Who was targeted by EquationDrug?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "EquationDrug targeted high-value institutions including government agencies, military command centers, aerospace manufacturers, nuclear research institutes, and telecommunication carriers."
      }
    },
    {
      "@type": "Question",
      "name": "How did EquationDrug achieve persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "EquationDrug established persistence via signed kernel-mode rootkit drivers and groundbreaking hard drive firmware reprogramming that survived operating system re-installation and drive reformatting."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities were exploited by EquationDrug?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "EquationDrug utilized CVE-2010-2568 for LNK-based remote execution and CVE-2013-3881 for Windows kernel privilege escalation."
      }
    },
    {
      "@type": "Question",
      "name": "What was the operational timeline of EquationDrug?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "EquationDrug was actively deployed between 2010 and 2013 before being superseded by the more advanced GrayFish platform."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1068",
    "T1542.002",
    "T1014",
    "T1070.004",
    "T1005",
    "T1560.003"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation",
      "tactic": "privilege-escalation"
    },
    {
      "id": "T1542.002",
      "name": "Component Firmware",
      "tactic": "persistence"
    },
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1070.004",
      "name": "File Deletion",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1005",
      "name": "Data from Local System",
      "tactic": "collection"
    },
    {
      "id": "T1560.003",
      "name": "Custom Cryptographic Protocol",
      "tactic": "command-and-control"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2010,
  "lineage": {
    "derived_from": [
      "doublefantasy"
    ],
    "variants": [
      "equationdrug v1.x",
      "equationdrug kernel rootkit (nls_933w.dll)",
      "grayfish (successor)"
    ]
  },
  "attribution": [
    {
      "actor": "Equation Group",
      "confidence": "high"
    },
    {
      "actor": "Tailored Access Operations (TAO)",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2013-3881"
  ],
  "c2_profile": {
    "protocols": [
      "TCP",
      "UDP",
      "Raw-Sockets"
    ],
    "ports": [
      443,
      80,
      53
    ],
    "traffic_identifiability": "high"
  },
  "iocs": {
    "file_hashes": [
      "7aa99c43e120ea96847cbb6509ec254388e6cc810e9c60e34b9d0317e0b5de78",
      "37f26792a95c3702a4bf702a837774bb9f1a0d33e9b1d9bf5bdf41b9e2c6c06a"
    ],
    "delivery": [
      "targeted_exploit_delivery",
      "interdicted_media"
    ],
    "persistence": [
      "Signed Kernel Driver",
      "HDD Firmware Re-flash",
      "Registry Virtual File System"
    ]
  },
  "sources": [
    {
      "name": "Kaspersky Lab GReAT: Equation Group Questions and Answers",
      "url": "https://securelist.com/equation-group-questions-and-answers/68756/"
    },
    {
      "name": "Kaspersky Report: Inside EquationDrug Espionage Platform",
      "url": "https://securelist.com/inside-the-equationdrug-espionage-platform/69203/"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "containment_steps": [
    "Decommission compromised hardware systems where storage device firmware may have been overwritten.",
    "Deploy memory analysis tools (e.g. Volatility) to inspect unlinked kernel drivers and hooked SSDT tables.",
    "Block outbound communications matching Equation C2 domain conventions and raw socket behaviors.",
    "Implement secure UEFI boot enforcement and hardware root-of-trust verification across critical infrastructure."
  ],
  "what_to_avoid": [
    "Do not assume operating system formatting removes firmware-level rootkit implants.",
    "Avoid deploying sensitive systems on unpatched legacy operating systems lacking Driver Signature Enforcement.",
    "Never insert untrusted USB removable media into air-gapped critical networks."
  ],
  "target_industries": [
    "aerospace",
    "defense",
    "nuclear",
    "telecommunications",
    "government"
  ],
  "motivation": "State-Sponsored Cyber Espionage",
  "threat_actors": [
    "Equation Group"
  ],
  "target_geographies": [
    "IR",
    "RU",
    "PK",
    "AF",
    "SY",
    "CN"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "privilege-escalation",
    "collection",
    "exfiltration"
  ],
  "ecosystem": [
    "windows",
    "x86",
    "x64"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}