Equation Group

The Equation Group is a threat actor, believed to have ties to the United States, that has been involved in numerous cyber espionage operations. The group's favorite vulnerabilities include CVE-2017-0144, a Windows server message block code execution vulnerability that was leaked by another group known as Shadow Brokers. Notably, the Equation Group developed an exploit named EpMe for this vulnerability as early as 2013, before it was publicly identified and labeled as CVE-2017-0005. Additionally, the group utilized another exploit, EpMo, which has not been discussed previously. In 2022, the China-linked cyber espionage group APT31 (also known as Zirconium, Judgment Panda, and Red Keres) made headlines when it was discovered that they had used a tool called Jian, a clone of the Equation Group's EpMe hacking tool. Interestingly, APT31 used this tool years before it was leaked online by Shadow Brokers. This event led to the misattribution of the CVE-2017-0005 vulnerability to APT31, rather than the Equation Group, who were its original creators. Equation Group's tools have been found in systems affected by various cyber attacks, including the WannaRen variant. Although the correlation between the new WannaRen variant and the use of the Shadow Brokers' toolkit (the leaked Equation Group tools) has not been fully verified, many of the systems affected by WannaRen contained these hacking tools. Furthermore, it has been observed that a single individual could leverage these publicly-known resources to cause damage equivalent to a nation-state attack. For instance, one custom hacking tool combined four leaked Equation Group tools (EternalBlue, EternalRomance, DoublePulsar, SMBTouch) into a single executable.