Forensia CTI Core

Profile

Equation is a sophisticated threat group that employs multiple remote access tools. The group is known to use zero-day exploits and has developed the capability to overwrite the firmware of hard disk drives.

MITRE ATT&CK ↗

Techniques

4 ATT&CK techniques attributed to this actor.

T1120 Peripheral Device Discovery T1480.001 Environmental Keying T1542.002 Component Firmware T1564.005 Hidden File System

Related corpus activity

26 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Equation.

Indicator	Type	Family	Sev	Src
415b253a81e67c8c860a97c73edc9017ce732b3c025d943d3b1a445b4ac82822	sha256	—	80	1
33d887ca2e57fa03fc807dfba5376bf96718ee88f56e90d95ee4896a2c019bd0	sha256	—	80	1
5aa7afd790481ad98357636fa4d9927ae01111409c8d7ce69998d2485c1d5e6f	sha256	—	80	1
95cda8431419f77407484ab72dc1e356421dcd801eccabe8869f77ee0eb58eb2	sha256	—	80	1
dfa9c6adac98311d0f62e0eeecb947d92f7bda41ddf4ce9a6f9e20af7990422d	sha256	—	80	1
185633e5dbe9235fc7e6a1ccb8631650afefd8f7da88c5c07d9b99ea38159822	sha256	—	80	1
f9f6c0184cee9c1e4e15c2a73e56d7b927ea685b	sha1	—	78	1
fc0c691db7e2d2bd3b0b4c1e24d18df72168b7d9	sha1	—	78	1
01a33066fbc6253304c92760916329abd50c3191	sha1	—	78	1
2b81f78ec4c3f8d6cf8f677d141c5d13c35333af	sha1	—	78	1
409c5acaed587f62f7e23da47f72c4d9ec3144d9	sha1	—	78	1
59a9b9d47ae36411b277544f25ad2cc955d8dd2c	sha1	—	78	1
95bdb94f6767a3cce6d92363bbf5bc84b786bdb0	sha1	—	78	1
7356d7868c81499fb4e720f7c9530e5763b4c1d0	sha1	—	78	1
21ca0287ec5eaee8fb2f5d0542e378267d6ca0a6	sha1	—	78	1
03e3ece9f48cf4104aafc535790ca2fb3c6b26cf	sha1	—	78	1
2c6cc71b7e7e4b28c2c176b504bc5bdb687c4d41	sha1	—	78	1
5b70453ab58824a65ed0b6175c903aa022a87d6a	sha1	—	78	1
d9a369e328ea4f1b8304b6e11b50275f798e9d6b	sha1	—	78	1
a48b62e55a692bf6d1046d2be64d7150	md5	—	76	1
7331602726f61959d8f0e7820d457370	md5	—	76	1
23a1eacad84be4f2c5830755b1948582	md5	—	76	1
3d3d2dc34f01bcf890f185a5421836c7	md5	—	76	1
72ac1287a8d71b27c437ec1f379ab506	md5	—	76	1
a0830ce48537ba052f1d3b905d11a5bf	md5	—	76	1
www.inodea.com	domain	—	65	1