Equation Group

The Equation Group, a threat actor suspected of having ties to the United States, has been associated with various sophisticated cyber exploits. The group's EpMe exploit, which existed since at least 2013, was the original exploit for the vulnerability later labeled CVE-2017-0005. Another exploit, EpMo, has also been linked to the Equation Group, although it had not been discussed previously. Tools and techniques used by the Equation Group have been found in several affected systems, indicating their widespread use. For example, a custom hacking tool that combines four leaked Equation Group tools (EternalBlue, EternalRomance, DoublePulsar, SMBTouch) into a single executable was discovered. In 2022, APT31, a China-linked cyber espionage group also known as Zirconium, Judgment Panda, or Red Keres, made headlines when it was revealed that they used a tool called Jian. This tool is a clone of the Equation Group’s “EpMe” hacking tool, and it was used years before it was leaked online by Shadow Brokers hackers. Interestingly, the Equation Group's EpMe exploit was cloned by APT31, leading to the attribution of CVE-2017-0005 to APT31 instead of the Equation Group. The potential damage caused by these exploits is significant. In one instance, many of the systems affected by the WannaRen variant were found to contain the Equation Group's hacking tools. Although the correlation between the new WannaRen variant and the use of the Shadow Brokers’ toolkit (the leaked Equation Group tools) in this recent attack is yet to be fully verified, it is evident that such resources can cause as much harm as a nation-state attack. Furthermore, the publication of an Equation Group exploit on GitHub for the last four years highlights the accessibility of these tools to potential malicious actors.